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1 Prehmma.ry remarks -a The text munedmtely precedmg this devoted itself almost 
exclusively to polyalphabet1c subst1tut10n systems of the type called repeatmg-key ciphers 
It was seen how a regulanty m the employment of a lnmted number of alphabets results m the 
mamfestat10n of penod1c1ty or cyLhc phenomena m the cryptog1.un, by means of which the 
latter may be solved 
The drlficulty m solution is directly correlated \\-1th the type and number 
of cipher alphabets employed m specifk examples 
b Two pioceJures suggest themselves fox wnsiJe1J.t10n \\hen the student c,ryptanalyst 
realizes the foregomg oicumstances and thlnks of methods to ellli1mate the weaknesses mherent 
m tlus cryptographic system 
First, notmg that the <Lffkulties m solution mcrease as the 
length of the key mcreases, he may study the effects of employmg much longer keys to see if 
one would be "\\-arranted m placmg much trnst m that 111ethod of increasmg the secunty of the 
messages 
Upon second thought, hO\ eve1, rm .e1~iliermg il at as a general rule the first step 


m the solution consists m asLertammg the number of alphabets employed, it seems to him that 
the most logical thmg to do "\\-ould be to use a pioLedme "\\-lu1.,,h "'ill avoid penod1c1ty altogether, 
"Will thus ehmmate the cydic phenome'la tLat axe normally manifested m cryptograms of a 
penod1c constru1,t10n, and thus pre"ent ::m enc!ny cryptan<llybt from taking even a first step 
toward solut10n 
In other woiJs, he "\\-1ll 11h e5tlga.~e the possibilities of aperiodic systems first 


and if the results are unsatisfacto1y, he "'ill then see what he ran do with systems usmg lengthy 
keys 
c Accordmgly, the first part of tlns !:e'i..t "Will 1:,e devoted to an exanunat1on of certam of the 
very srmple vaneties of apenod1c, polyalphabetic substitution systems, after tlus, methods of 
extendmg or lengthening short mnemoru<., keys, and systems usmg lengthy keys will be studied 
2 General remarks upon the nature of cryptographic period1c1ty-a When the thoughtful 
student considers the matter of p&1.odicity m polyalphabetic substitut10n systems and tries to 
ascertam its real nature, he notes, with some degree of mterest and surpnse perhaps that it is 
composed of two fundamental factors, because there are m reality two elements mvolved m its 
production 
He has, of course, become qmte familiar with the idea that penochc,ity necesSitates 


the use of a keymg element and that the latter must be employed m a cychc manner 
But he 
now begms to realize that there 1s another element mvolved, the s1gmficance of which he has 
perhaps not fully appreciated, viz, that unless the key is apphed to constant-length plam-text 
groups no penod1city w1.ll be manifested externally by the cryptogram, despite the repetitive or 
cyclic use of a constant-length key 
This realization is qmckly followed by the idea that possibly 
all penod1city may be avoided or suppressed by either or both of two ways (1) By usmg constant- 
length keymg units to encipher vanable-length plam-text groupings or (2) by usmg vanable- 
length keymg uruts to encipher constant-length plam-text groupmgs 
b The student at once reahzes also that the penod1c1ty exhibited by repeatmg-key ciphers 


of the type studied m the precedmg text 1s of a very Simple character 
There, succesSive letters 
of the repetitive key were apphed to succesSive letters of the text 
In respect to the employment 
of the key, the cryptographic or keymg process may be said to be constant or fixed m character 
This ternunology remams true even if a smg~ keymg unit serves to encipher two or more letters 
(1) 


2 


at a trme, provided only that the groupmgs of plam-text letters are constant m length 
For 
example, a smgle key letter may serve to encipher two successive plam-text letters, 1f the key is 
repetitive m character and the message is sufficient m length, per10d1c1ty will still be mamfested 
by the cryptogram and the latter can be solved by the methods mdicated m the precedmg text 1 
Naturally, those methods would have to be modified ill accordance with the specific type of 
groupmg Involved 
In this case the factonng process would disclose an apparent key length 


twice that of the real length 
But study of the frequency distributions would soon show that 
the 1st and 2d distnbut10ns were similar, the 3d and 4th, the 5th and 6th, and so on, dependmg 
upon the length of the key 
The logical step 1s therefore to combme the distnbut10ns m proper 


prurs and proceed as usual 
c In all such cases of enc1pherment by constant-length groupmgs, the apparent length of 
the period (as found by applymg the factormg process to the cryptogram) IS a multiple of the 
real length and the multiple corresponds to the length of the groupmgs, that is, the number of 
plam-text letters enciphered by the same key letter 
d The pomt to be noted, however, is that all these cases are still penod1c m character 
because both the keymg uruts and the plam-text groupmgs are constant m length 
' 
3 Effects of varying the length of the plam-text groupmgs -a But now consider the effects 
of makmg one or the other of these two elements variable m length 
Suppose that the plam-text 
groupmgs are made vanable m length and that the keymg uruts are kept constant m length 
Then, even though the key may be cychc m character and may repeat itself many times m the 
course of encipherment, external per10dicity 1s suppressed, unless the law governing the variation 
in plain-text groupings is itself cyclw in characterJ and the length of the message is at least two or 
more times that of the cycle applicable to this variable grouping 


b (1) For example, suppose the correspondents agree to use reversed standard cipher 


alphabets with the key word SIGNAL, to encipher a message, the latter bemg divided up mto 
groups as shown below 
s 
I 
G 
N 
A 
L s 
I 
G 
N 
A L 
s 
I 
G 
1 12 123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345 
c OM 
MAN 
DING 
GENER A LF 
IRS 
TARM 
YHASI s SU 
EDO 
RDER 
SEFFE 
g uw 
UGT 
KFAH 
UWNWJ 
L HN 
ARQ 
NGPU 
PG NVF 
I 
TR 
OPE 
RFER 
OCBBC 


N 
A 
L 
s 
I 
G N 
A 
L 
s 
I 
G 
N 
A 
L 
1 
12 
123 1234 12345 1 12 123 1234 12345 1 12 123 1234 12345 
c TI 
VET 
WENT 
YFIRS 
T AT 
NOO 
NDIR 
ECTIN G TH 
ATT 
ELEP 
HONES 
L HS 
QHS 
WOFZ 
KDARQ 
N NU 
NMM 
YIDU 
OQZKF c NZ 
NUU 
WPWL 
EXYHT 
s 
I 
G 
N 
A 
L s 
I 
1 12 123 1234 12345 1 12 123 
c OM 
MAS 
WITC 
HBO AR 
D SC 
OMM 
g uw 
UGO 
RFUL 
TZMAJ 
I 
AQ 
uww 


CRYPTOGRAM 


QUWUG 
TKFAH 
UWNWJ 
LHNAR 
QNGPU 
PG NVF 
ITROP 
ERFER 
OCBBC 
LHSQH 
SWOFZ 
KDARQ 
NNUNM 
MY I DU 
OQZKF 
CNZNU 
UWPWL 
EXYHT 
QUWUG 
ORFUL 
TZMAJ 
IAQUW 
w 


l!'IOUBll 1 


1 In this connection, see Section Ill, Militar11 Cryptanalyaia, Part 1r, 
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(2) The cipher text m this example (Fig 1) shows a tetragraphic and a pentagraphic 
repetit10n 
The two occurrences of QUWUG (=COMMA) are separated by an illterval of 90 


letters, the two occurrences of ARQN ( = IRST) by 39 letters 
The former repetition ( QUWUG) , 
1t will be noted, is a true per10d1c repetit10n, smce the plam-text letters, their groupmg, and 
the key letters are ident1c,al 
The IDterval ID this ca<>e, if counted m terms of letters, is the 
product of the keymg cycle, 6, by the groupmg cycle, 15 
The latter repetit10n (ARQN) is not 
a true per10dic repetit10n ID the sense that both cycles have been completed at the same pomt, 
as IS the case ID the former repet1t10n 
It 1s true that the cipher letters ARQN, representmg 


IRST both times, are produced by the same key letters, I and G, but the enmphermg pomts m 
the groupillg cycle are different m the two cases 
Repetitions of this type may be termed 


partially periodic repetit10ns, to distmgmsh them from those of the completely periodic type 
c When the mtervals between the two repet1t1ons noted above are more carefully studied, 
especially from the pomt of view of the mteractIDg cycles which brought them about, it wtll be 
seen that countmg accordmg to groupings and not accordmg to smgle letters, the two pentagraphs 
QUNUG are separated by an interval of 30 groupmgs 
Or, if one prefers to look at the matter m 
the light of the keymg cycle, the two occurrences of QUWUG are separated by 30 key letters 
Smee the key is but 6 letters m length, this means that the key has gone through 5 cycles 
Thus, 
the number 30 is the product of the number of letters m the keymg cycle (6) by the number 
of different-length groupmgs m the groupmg cycle (5) 
The mteract1on of these two cycles 
may be conceived of as pai takmg of the nature of two gears which are m mesh, one dnven by 
the other 
One of these gears has 6 teeth, the other 5, and the tc.>eth are numbered 
If the 
two gears are ad1usted so that the "number 1 teeth" .11e adjacent to each other, and the gears 
are caused to revolve, these two tePth will not come togethPr agam until the larger gear has 
made 5 rcvolut10ns and the smaller one 6 
Durmg this tune, a total of 30 meshings of individual 


teeth will have occurred 
But smce one revolut10n of the smaller gear (=the groupmg cycle) 
represents the encipherment of 15 letters, when translated ID terms of letters, the 6 complete 
revolut10ns of this gear mean the enc1pherment of 90 letters 
This accounts for the period of 


90, when stated ID terms of letters 
d The two occurrences of the other repet1t10n, ARQN, are at an IDterval of 39 letters, but 


m terms of the number of mtervenmg groupmgs, the mterval 1s 12, which is obviously two 
times the length of the keymg cycle 
In other words, the key has m this case passed through 2 
cycles 
e In a long message enciphered according to such a scheme as the foregomg there would 
be many repet1t10ns of both types discussed above (the completely penodic and the partially 
periodic) so that the cryptanalyst might encounter some difficulty ill his attempts to reach a 
solut10n, especially if he had no mformat10n as to the basic system 
It is to be noted m this 
connect10n that if any one of the groupIDgs exceeds say 5, 6, or 7 letters m length, the scheme 
may give itself away rather easily, sIDce it is clear that 'IJ.Jl1hin each grouping the encipherment is 
strwtly monoalphabetic 
Therefore, m the event of groupmgs of more than 5 or 6 letters, the 
monoalphabetic eqmvalents of tell-tale words such as ATTACK, BATTALION, DIVISION, 
etc , would stand out 
The system is most efficac10us, therefore, with short groupmgs 
f It should also be noted that there is nothing about the scheme which reqmres a regularity 
m the groupmg cycle such as that embodied m the example 
A lengthy groupmg cycle such as 
the one shown below may 3ust as easily be employed, it bemg gmded by a key of its own, for 
example, the number of dots and dashes contamed m the Internat10nal Morse signals for the 
letters composmg the phrase DECLARATION OF INDEPENDENCE nnght be used 
Thus, A ( -) 
has 2, B (_ ••• ) has 4, and so on 
Hence 
D E C L A R A T I 0 N 0 F I N D E P E N D E N C E 
a 1 
• 
• 
2 a 2 
i 
2 a 2 a 
~ 2 
2 a 1 
• 
i 
2 a i 
2 
• 
1 
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The groupmg cycle is 3+1+4+4+2 
, or 60 letters m length 
Suppose the same phrase 
1s used as an enc1phermg key for determmmg the selection of cipher alphabets 
Smee the 
phrase contams 25 letters, the complete penod of the system would be the least common multiple 
of 25 and 60 or 300 letters 
Tlus system might appear to yield a very lugh degree of crypto- 


grapluc security 
But the student will sec as he progresses that the secunty is not so high a~ 


he may at first glance suppose it to be 
4. Primary and secondary periods, resultant periods -a It has been noted that the length 
of the complete period m a. system such as the foregomg 1s the least common multiple of the 
length of the two component or mteractmg periods 
In a way, therefore, smce the component 


periods constitute the basic element oi the scheme, they ma} be designated as the basic or primaT?J 
periods 
These are also hidden or latent peuods 
The apparent or patent penod, that is, the 
complete penod, may be designated as the secondary or resultant period 
In certain types of 


cipher machmes there may be more than two pnmary penods wluch mteract to produce a 
resultant period, also, there are cases m '"hich the latter may mternct with another pnm'lry 
penod to produce a tertiary penod, and so on 
The final, or resultant, or apparent period Is the 
one wluch is usually ascertamed first as a result of the study of the mtervals between repetitwm 
This ma.y or may not be broken down mto its component prrmary penods 
b Although a. solution may often be obtained without breakmg down a resultant penod 
mto its component pnmary penods, the rcadmg oI many messages pcrtammg to a widespread 
system of secret commurucat1on is much facilitated when the analysis 18 pushed to its lowest 
level, that is, to the pomt where the fmal cryptogr.lpluc sc,heme has been icduced to its srmplest 
terms 
Tlus may mvolve the discovery ol a m,ilt1phc1ty of sm1ple clements which mteract m 


successive cryptograpluc strata 


j 


SECTION II 


SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER 


VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, I 


l'.i.r<\llnph 
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5. Introductory remarks -a The system descnLed m p.i. agraph 3 abo\ e is ob nously riot 
to be classified as aprnod1r Ir nature, dci.p1te the IDJect10n of a vnuahle factor \Vlnch mthnt 
case \\a.s based upon megula1 1ty m the leugtb of one of the two clement':! mvolvcd m pol)a.lpha- 
betic substitution 
The v:muble factor WJ.s there suhJect to a In.\\ \\lnch m itself was por1ochc 
m character 
b To mnke such a sy<Jtcm trnly aper1od1c m character, by elaborating upon the ba':!lC 


scheme for pr0ducn•g v1111,1ble-leni;th plam-text grouping,,,, would be posb1ble, but unpractical 
For example, usmg the E>ame rneth0d as is r;1ven m pa.ragr.1ph 3} fo1 determmmg the lengths of 
the groupmgs, one might employ the text of a Look, and If t},p httcr 1s longer than t1'e messag~ 
to be enciphered, the l'rvptogram would ccrtamly show no period1c1ty as regardi. tl1e mtervalb 
between repetitions, '\\h1ch \vould be plentiful 
IIoweV"er, as already md1cated, E.uch a <,chcme 


would not be very practical for regular commumcation between a large number of correspondents, 
for reasons wluch are no doubt apparent 
The book would have to be safeguarded as would a 
code, enc1phenng and demphermg would be qmte slow, cumbersome, and subJect to erro1, 
and, un1co:s the same key kll.t weie u~ed for all messages, methods or md1cators would have to 
be adopted to show exactly where enc1phe1ment begms m each message 
A slmpler method 


for producing constantly cl.ang:mg, npcnod1c plum-text groupmgs therefore, is to be sought 
6 Aperiodic enc•phern:.ent produced by groupings accordmg to word lengths -a The 


simplest method for prodl1cmg aperiodic pla.n-text groupmgs is one which has doubtless long 
ago presented itself to the ~t 1dl'nt, viz, cnc1pherment accordmg to the actual word lengths of 
the me"'sage to be enciphered 
b Although the average number of letters composmg the words of any alphabetical language 


is fall'ly constant, succPss1ve word'> compn<;img plam text vary a great deal m this respect, and 
tlus vanat1on is sub1ect to 110 law 1 In telegrapluc English, for example, t1e mean length of 
words is 5 2 letters, the words may contam from 1 to 15 or more letters, but the succ,ess1ve 
words vary m length In an extremely irregular manner, no matter how long the text may be 
c As a consequence, the use of word lengthi. for detcrmlDIIlg the number of letters to be 


enmphered by each key letter of a repetitive key commends itself to the mexpeuenced cryptog- 
rapher as soon a<1 he {'Orne~ to tmdcrstand the way m which repeatmg-key ciphers are solved 
If there is no penod1c1ty m the cryptograms, how {'an the letters of the cipher text, Wl'ltten m 


t It 1s true, of course, that the d1ff<'ren!'r'I h<'t\\c <'n two VI ritLrs m re'lpect to the lengths and characters of 
the words contamcd m their personal vocabt'latws arc oft"n m'lrk<'d and Mn be measured 
The'!L d fferonces 
may be subJect to ccrtam l.i.Vls, but the latter arc not of thL t)'pP m wluch VIC ar<' rntcie<ikd, bemg J>'lycho1og1cal 
rather th'ln mathematwal m character 
See Rickert, E, New Methods for the Study of Literature, Umvers1ty of 


Chicago Press, Chicago, 1927 
(5) 
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fi-letter groups, be distributed mto their respective monoalphabets? And if this very first step 
is 1mposs1ble, how can the cryptograms be solved? 
7 Solution when direct standard cipher alphabets are employed - a Despite the foregomg 


rhetorical quest10ns, the solut10n of tlus case is really qmte simple 
It merely mvolves a modifi- 
cat10n of the method given m a prev10us text, 2 wherem solut10n of a monoalphabetw cipher 
employmg a direct standard alphabet is accomplished by completmg the plam-component 
sequence 
There, all the words of the entire message come out on a smgle generatrix of the 
complet10n diagram 
In the present case, smce the mdiv1dual, separate words of a message 
are enciphered by different key letters, these words will reappear on different generatrices of the 
diagram 
All the cryptanalyst has to do Is to pick them out 
He can do this once he has found 
a good startmg pomt, by usmg a little 1magmat10n and followmg clues afforded by the context 
b An example will make the method clear 
The followmg message (note its brevity) has 
been mtercepted 
T R E C S 
Y G E T I 
SVAGR 
XUXPW 
LU V WV 
V M T U C 


I K M Q I 
SY X G X 
RX SP J 
V H F F B 
LLB HG 
c Subm1ttmg the message to routme study, the first step is to use normal alphabet strips 


and try out the poss1b1lity of direct standard alphabets havmg been used 
The complet10n 


diagram for the first 10 letters of the message is shown m figure 2 
d Despite the fact that the text does not all reappear on the 
same generatrix, the solut10n Is a very simple matter because the 
first three words of the message are easily found 
CAN YOU GET 
The key letters may be sought m the usual manner and are found 
to be REA 
One may proceed to set up the remammg letters of 
the message on slidmg normal alphabets, or one may a-;sume 
var10us keywords such as READ, REAL, REAM, etc , and try to 
contmue the dempherrnent m that way 
The former method is 
easier 
The completed solut10n is as follows 


R 
E 
A 
D 
E 
R 
S 


CAN 
YOU 
GET 
FIRST 
REGIMENT 
TRE 
CSY 
GET 
ILUVW 
VIKMQIRX 


BY 
RADIO 
SP 
JSVAG 
D 
I 
G 
E 
S 


OUR 
PHONE 
NOW 
OUT 
OF 
RXU 
XPWVM 
TUC 
SYX 
GX 


T 


COMMISSION 
VHFFBLLBHG 
e Note the key m the foregomg case It is composed of the 
successive key letters of the phrase READERS DIGEST 
f The only difficult part of such a solut10n is that of makmg 
the first step and gettmg a start on a word 
If the words are 
short it is rather easy to overlook good poss1b1lit10s and thus 
spend some time m frmtlecis searchmg 
However, solution must 
come, If nothmg good appears at the begmmng of the message, 
search should be made m the mter10r of the cryptogram or at 
the end 


1 Military Cryptanalysis, Part I, Par 20 


T R E C S Y G E T I 
U S F D T Z H F U J 
V T G E U A I G V K 
WUHFVBJHWL 
X V I G W C K I X M 
YWJHXDLJYN 
Z X K I Y E M K Z 0 
AYLJZFNLAP 
B Z M K A G 0 M B Q 
C A N L B H P N C R 
D B 0 M C I Q 0 D S 
ECPNDJRPET 
FDQOEKSQFU 
GERPFLTRGV 
HFSQGMUSHW 
IGTRHNVTIX 
J H U S I 0 W U J Y 
K I V T J P X V K Z 
LJWUKQYWLA 
MKXVLRZXMB 
NLYWMSAYNC 
0 M Z X N T B Z 0 D 
P N A Y 0 U C A P E 
Q 0 B Z P V D B Q F 
R P C A Q W E C R G 
SQDBRXFDSH 


F'IGUllJ: 2 
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8. Solution when reversed standard cipher alphabets are employed -It should by this time 


hardly be necessary to md1cate that the only change m the procedure set forth m paragraph 
7 c d m the case of reversed standard cipher alphabets is that the letters of the cryptogram mu cit 
b: converted mto their plam-component (direct standard) eqmvalents before the complet10n 
sequence is applied to the message 
9. Comments on foregoing cases -a The foregomg cases are so simple m nature that the 


detailed treatment accorded them would seem hardly to be warranted at this stage of study 
However, they are necessary and valuable as an mtroduct10n to the more complicated cases to 
follow 
b Throughout this text, whenever encipherment processes are under d1scuss10n, the pair 


of enc1phermg equat10ns commonly referred to as charactenzmg the so-called Vigenere method 
will be understood, unless otherwise md1cated 
Thls method mvolves the pair of enciphering 


equations e111=8i,12 , 0p11=0c12, that is, the mdex letter, whwh is usually the m1tial letter of the 
plam component, is set opposite the key letter on the cipher component, the plam-text letter 
to be enmphered is sought on the plam component and its eqmvalent is the letter opposite it 
on the cipher component 3 
c The solut10n of messages prnpared accordmg to the two precedmg methods is particularly 
easy, for the reason that standard mpher alphabets are employed and these, of course, are denved 
from known components 
The significance of this statement should by this trme be qmte 


obvious to the student 
But what if IDIXed alphabets are employed, so that one or both of the 
components upon which the mpher alphabets are based are unknown sequences? The srmple 
procedure of completmg the plam component obv10usly cannot be used 
Smee the messages 
are polyalph11bet1c m character, and smce the process of factormg cannot be apphed, it would 
seem that the solution of messages enciphered m drlferent alphabets and accordmg to word 
lengths would be a rather difficult matter 
However, it will soon be made clear that the solution 


is not nearly so difficult as first rmpress1on lllght lead the student to 1magme 


a Seem tlus connection, Military Cryptanalysis, Part Il1 Section II, and Appendix 1 


Si.CTION III 


SOLUTION OF SYSTEl\ilS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER 


VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, II 


Paragraph 
Solution \'\hen the or1gmal wm cl lengths are retamed m the cryptogram 
__ _ __ _ __ -------- ____ -------------- 
10 
Solution when other types of alphabets aie employed ------- __________ ------- _____ 
_ ______ ----------- __ -------- 
11 


Ibomorph11;,m aud itt. 1mpo1 tauc,c m cryptanal)' i1Ls __ __ ------- __ 
_ __ ----------- ____ ----- -------------- -------- ll 
Illustr.i.t10n of the apphLat1ou of phLnomena of 1'lomorph1~m m solvmg a cryptog1am 
_ 
_ ______ ____ __ __ 
13 


10 Solution when the original word lengthc;; are retained m the cryptogram -a This case 


will be discussed not because it is encountered m practical nnhtnry cryptography but because it 
affords a good mtroduct1on to the case m which the origmal w01<l lengths are no longer m evi- 
dence m the cryptogtam, the latter appea.rmg m the usual 5-letter groups 
b Reference is made at this pomt to the phenomenon called idiomorph1sm, and its value m 


connection with the apphcat10n of the prmmples of solut10n by the "probable-word" method, 
as explamed m a prcv10us te"Ct 1 
When the original word lengths of a message are retamed m 


the cryptoffl'am, there is no diflkulty 1'1 senrchmg for and locatmg i<l1omorphs and then makmg 
comparisons between these id.10morrl11c c;cquenccs m the message and special word patterns 
set forth m hsts ma.n tinned for till' purpose 
For eJ..nmple, m the followmg message note the 


underlined groups and study the letters withm tl1esc groups 


MESSAGE 


XIXLP EQVIB 
VEFHAPFVT 
RT 
XWK 
PWEWIWRD 
XM 


NTJCTYZL 
OAS 
XYQ 
ARVVRKFONT 
BH 
§...L..4DUUXFP 
OUVIGJPF ULBFZ 
RV 
DKUKW 
ROHROZ 


( 1) 


(4) 


PWEWIWRD 
-:...._;-'--""- 


R 0 H R 0 Z 
-...____, 


IDIOMORPHIC SI< QUENCES 


(2) A R v •• v R K F 0 NT 


'--"" 


(3) s E J Du U XE P 


c Reference to hstc; of words commonly found 111 rmhtary text and arranged accordmg to 


their 1diomorph1c pattern., or formulae soon gives suggest10ns for these cipher groups 
Thus 


(1) 
PW E WI WR D 
D I V I S I 0 N 
-'-7"-7 


(2) 
A R V V R K F 0 N T 
B A THT A L I 0 N S 
'--"" 
1Military Cryptanalysis, Part I, Par 33 a,-d, mclut.1vc 


(8) 


(3) 
S F J DU U X F P 
A R T I L L E R Y 
- 
-- -7 


(4) 
ROHROZ 
0 C L 0 C K 
-"----"" - 


9 


d With these assumed eqmvalents a reconstruction skeleton or dmgram of cipher alphabets 


(fornnng a portion of a quudncular table) is estabh<ihed, on the h1 pothes1s that the cipher 
alphabets have been de11ved from the sl1dmg of a mi'\.ed component agmnc;t the normal se- 
quence 
First it is note<l that smce 011=Rc both m the wo1d DIVISION and m the \\Old OCLOCl{ 
their cipher eqmvalents must be m the same nlphabet 
The rnconstI uct1on skeleton IS then as 
follows 


A B c D E F G H I J K L M N 0 p Q R s T u v w x y z 


Division, 
'=- - 
1= - 
'-= ·= - 
- 
I= - 
- 
- 
I= - 
-- - 
- - 
- 
- 
- 
·-= ·= - 
- 
- 
o'clock _____ (l) 
0 p 
w 
z H 
D R 
I 
E 
- 
- 
- - 
- - - ,_ - -- - 
- 
- 
-- - 
- 
- 
- - 
- 
- 
- 
- 
- ,_ - 
Battahon ____ (2) R A 
F 
K 
N 0 
T v 
- 
- 
- 
- 
- 
- 
- ,_ - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- - - ,_ - ,_ 


Artillery _____ (3) s 
x 
D 
u 
F 
J 
p 


FlGUBB 3a 


e Notmg that the mterval between 0 and Rm the firc;t an<l second alphabets is the same, 


direct symmetry of poc;ition is assumed 
In a few moments the firc;t alplmbet m the skeleton 
becomes as follows 


(1 


(2 


(3 


A 
- 
) 


) R 
- 
) s 


B 
- 
N 


A ·- 


c D E 
- 
- 
- 


0 p 
- 
- 


- ·- -x 


F G H I J K 


- 
- 
- 
- 
- 
- 
s T v w x z 
- 
- 
- ,_ - - 
F 
- 
- 
-- - 
- 
- 
D 


L M N 0 p Q R s T u v w x y z 
- ---I- - 
- 
- 
- 
- 
~-- 
- 
- 
,___ ,___ - 
H 
D R A u 
I 
E F 
J K 


- - -- - 
- 
- 
,___ - 
- 
K 
N 0 
T v 
- 
- 
- 
- 
- 
- 
- 
u 
F 
J 
p 


J!lGUP.lll 3b 


J The key word upon which the rmxed component is based is now not difficult to find 
HYDRAULIC 
g (1) To decipher the entire message, the sunplest procedure is to convert the cipher 


letters mto their plam-component eqmvalents (setting the HYDRAULIC 
Z sequence agamst 


the normal alphabet at any pomt of comCldence) and then completmg the plam-component 
sequence, as usual 
The words of the message will then reappear on different generatnces 
The 


10 


key letters may then be ascertamed and the solution completed 
Th 
z 
h fi 
h d 
us, ior t e rst three words 
t e 1agram 1s as follows 
' 


Plam_________________ A B C D E F G H I J K L M N 0 P Q R S T U V W X y z 
Cipher _______________ H Y D R A U L I C B E F G J K M N O p Q S T V W X z 


XIXLP 
EQVIB 
VEFHAPFVT 
YHYGS 
KTWHJ 
WKLAESLWV 
ZIZHT 
LUXIK 
XLMBFTMXW 
AJAIU 
MVYJL 
YMNCGUNYX 
BKBJV 
NWZKM 
ZNODHVOZY 
C L C K W 
0 X A L N 
A 0 P E I W p A z 
D M D L X 
P Y B M 0 
B P Q F J X Q B A 
E N E M Y 
Q Z C N P 
C Q R G K Y R C B 


Ap=S0 
R A D 0 Q 
D R S H L Z S D C 
S B E P R 
E S T I M A T E D 
T C F Q S 
U D GR T 
V E H S U 
W FIT V 
X G JU W 
YHKVX 
Z I L W Y 
A JM X Z 
BK NY A 
C L 0 Z B 
D M P A C 
E N Q B D 
F 0 R C E 


FIGURE 4 


(2) The key for the message is found to be SUPREME COURT and the complete m 
as follows 
essage ts 


SOLUTION 


S 
U 
P 
RE 
M 
E 
C 
o 


ENEMY 
FORCE 
ESTIMATED 
AS 
ONE 
DIVISION 
OF 
INFANTRY 
AND 


XIXLP 
EQVIB 
VEFHAPFVT 
RT 
XWK 
PWEWIWRD 
XM 
NTJCTyzL 
OAS 


R 
T 
S 
U 
PRE 
M 


BATTALIONS 
OF 
ARTILLERY 
MARCHING 
NORTH 
AT 
SEVEN 
OCLOCK 
ARVVRKFONT 
BH 
SFJDUUXFP 
OUVIGJPF 
ULBFZ 
RV 
DKUKW 
ROHROZ 


u 


TWO 
XYQ 


h In case the plam component is the reversed normal sequence, the procedure is no different 
f~om the foregomg, except that m the completion diagram the reversed sequence is employed 
a ter the cipher letters have been converted mto their plam-component eqmvalents 


i 
No doubt the student realizes from his previous work that once the primary mixed 


component has been recovered the latter becomes a kno'IJYn sequence and that the solution of 
subsequent messages employmg the same set of derived alphabets, even though the keys to 
md1vidual messages are different, then becomes a sunple matter 


11 


11 Solution when other types of alphabets are employed -a The foregomg examples 
mvolve the use either of standard cipher alphabets or of mixed cipher alphabets produced by 
the shdmg of a illlXed component agamst the normal sequence 
There is, however, nothmg 
about the general cryptographic scheme which prevents the use of other types of derived, 
mterrelated, or secondary mixed alphabets 
Cipher alphabets produced by the shdmg of a 
rmxed component agamst itself (either direct or reversed) or by the shdmg of two different 
mixed components are very commonly encountered m these cases 
b The solution of such cases mvolves only shght modificat10ns m procedure, namely, those 
connected with the reconstruct10n of the pnmary components 
The student should be m a 


position to employ to good advantage and without difficulty what he has learned about the 
principles of mdirect symmetry of position m the solut10n of cases of the kmd described 


c The solut10n of a message prepared with nuxed alphabets derived as mdicated m sub- 
paragraph b, may be a difficult matter, dependmg upon the length of the message m quest10n 
It might, of course, be almost impossible if the message Is short and there is no background for 
the apphcat10n of the probable-word method 
But if the message is qmte long, or, what is 


more probable with respect to m1htary commumcat10ns, should the system be used for regular 
traffic, so that there are available for study several messages enciphered by the same set of 
alphabets, then the problem becomes much easier 
In add1t10n to the usual steps m solut10n 


by the probable-word method, gmded by a search for and 1dent16.cat10n of 1d10morphs, there is 
the help that can be obtamed from the use of the phenomena of isomorphism, a study of which 
forms the sub1ect of discussion m the next paragraph 
12. Isomorplusm and its importance m cryptanalyt1cs.-a The term 1d10morphism is 


fam1har to the student 
It designates the phenomena ansmg from the presence and posit10ns 


of repeated letters m plam-text words, as a result of which such words may be classified accordmg 
to their compositions, "patterns,'' or formulae 
The term isomorphism (from the Greek "1sos" 


meamng "equal" and "morphe" meanmg "form") designates the phenomena arismg from the 
existence of two or more 1diomorphs with identical formulae 
Two or more sequences whwh 


possess identical formulae are said to be isomorphic 


b Isomorphism may exist m plam text or m cipher text 
For example, the three words 
WARRANT, LETTERS, and MISSION are isomorphw 
If enciphered monoalphabet1cally, their 
cipher eqmvalents would also be isomorphic 
In general, ISomorph1sm is a phenomenon of 
monoalphabet1c1ty (either plam or cipher), but there are mstances whcrem it IS latent and can 
be made patent m polyalphabet1c cryptograms 
c In practical cryptanalysis the phenomena of isomorphism afford a constantly astomshing 


source of clues and aids m solution 
The alert cryptanalyst is always on the lookout for s1tuat10ns 
m which he can take advantage of these phenomena, for they are among the most mterestmg 
and most rmportant m cryptanalytics 
13. IDustrat1on of the use of isomorphism -a Let us consider the case discussed under 
paragraph 10, wherem a message was enciphered with a set of mixed cipher alphabets denved 
from shdmg the key word-mixed prlillary component HYDRAULIC 
XZ agamst the normal 
sequence 
Suppose the message to be as follows (for s1Illphc1ty, ongmal word lengths are 
re tamed) 


CRYPTOGRAM 


V C L L K I D V S J D C I 
0 R K D C F S T V I X H M P P F X U E V Z Z 


FK NAKFORA DKOMP 


J Z W B C X H 0 Q C F F A 0 X 


I S E C S P P H Q K C L Z K S Q 
R 0 Y X A N 0 E M D M Z M T S 


L P R 0 


T Z F V U E A 0 R S L A U P A D D E R X P N B X A R I G H F X J X I 
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b (1) Only a few nnnutes mspection discloses the followmg three srts of isomorph<1 


(1) ! 


(a) 
(b) 
(<') 


Y:.Q!:d,~KIQY:SJQ.Q! 
.Q § .E .E H Q. K .Q L Z K § Q. 
PADDERXPNBXAR 
(2) 


l 


(a) 
(b) 
I ~ H M _E .E F ~ U 
HQQCEEAQX 


f T '-- 
[ T T 
11 J 


I 
._ J 


(3) 
L 
I 
! 


(a) 
(b) 


NAKFORA 
ROYXANO 
-, 
FF"""- 


(2) Without stoppmg to iefar to \\Old-pattern lists m an uttempt to identify the very 
str1kmg id1omorphs of the first set, let the student p10Leed to bwld -up partial bequences of 
eqmvalents, as though he \\ere dealing \\Ith a c..c1.se of mdir~ct symmetiy of pos1t10n 
Thus 
2 


From ibomorphs (1) (a) and (1) (b) 


V-<>C, cos. LoP, K=e-H, IoQ, D=e-K, s=e-L, Joz, 


from which the followmg partial sequences are con<1tmcted 


(a) VCSLP 
(b) DKH 
(c) IQ (d) JZ 


From 1sornorphs (1) (b) and (1) (c) 


coP, so A, PoD, HoE, QoR, K<>X, LoN, Z-<>B, 


from which the followmg partial sequences arc constructed 


(e) CPD 
(f) SA 
(g) HE 
(h) QR 
(i) KX 
(J) LN 
(k) ZB 


From 1somorphs (1) (a) and (1) (c) 


V=C-P, CoA, Loo, KoE, IoR, o=e-x, S<>N, JoB, 


from which the followmg partial sequences are constructed 


(1) LOX 
(m) VP 
(n) CA 
(o) KE 
(p) IR (q) SN 
(r) JB 


Noting that the data from the three ISomorphs of this set may be combmed (VCSLP and CPD 
make VCSLP 
D, the latter and LOX make VCSLP 
D 
X), the followmg sequences are 


established 


(1){ ~ 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
c s 
L 
p 
A 
N 
D 
K 
H 
x 
E 


(2){ ~ 


2 
3 
" 


5 
Q 
R 


(3){~ 


2 
3 
4 
5 


z 
B 


c (1) The fact that the longest of these chams consists of exactly 13 letters and that no 


additions can be made from the other two cases of isomorphism, leads to the assumption that a 
"half-cham" is here disclosed and that the latter represents a dec1mat1on of the ongmal pnmary 


1 
2 
3 
4 
5 
6 
7 
8 
9 


component at an even mterval 
Noting the placement of the letters V 
S 
P 
N 
K , 


• The symbol ¢o is to be read "is equivalent to " 
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which gives the sequence the appearance of bemg the latter half of a keyword-rmxed sequence 
runrung m the reversed direction, let the half-cham be reversed and extended to 26 places, as 
follows 


1 
2 a ' s e 7 s 9 w u u u ~ u u u ~ ~ m n ~ ~ M z z 


E 
K 
N 
P 
S 
V 
X 
H 
D 
A 
L 
C 


(2) The data from the two partial chams (JZ Band IQ 
R) may now be used,and the 
letters mserted mto their proper poSitions 
Thus 


1 
2 s ' a e 7 s a w u u a u u u u a 
~ m n ~ ~ M z z 


E 
JK 
N 
PQS 
V 
XZH 
ORA 
LICB 


(3) The sequence H 
D R A 
L I C soon suggests HYDRAULIC as the key word 
When 
the rmxed sequence is then developed m full, complete corroboration will be found from the data 
of 1somorphs 2 (a) (b) and 3 (a) (b) 
Thus 


1 
2 a 4 a o 7 s o w u H a u ~ w u 
~ ~ m n ~ ~ M z z 
HYDRAULICBEFGJKMNOPQSTVWXZ 


(4) From 1d1omorphs (2) (a) and (2) (b), the mterval between H and I lS 7, it lS the same 
for 0 and X, Q and H, C and M, etc 
From 1d1omorphs (3) (a) and (3) (b) the mterval between 
Rand N is 13, it is the same for 0 and A, Y and K, etc 
d The message may now be solved qwte readtly, by the usual process of convertmg the 
cipher-text letters mto their plam-component eqwvalents and then completing the plam com- 
ponent sequences 
The solution lB as follows 


[Key STRIKE WHILE THE IRON IS 
(HOT?}] 


S 
T 
R 
I 
K 


COMMUNICATION WITH FIRST ARTILLERY WILL 
VCLLKIDVSJDCI ORKD CFSTV IXHMPPFXU EVZZ 


E 
W 
H 
I 
L 
E 
BE THROUGH CORPS AND COMMUNICATION WITH 
FK NAKFORA DKOMP ISE CSPPHQKCLZKSQ LPRO 


T 
H 
E 
I 


SECOND ARTILLERY THROUGH DIVISION 
JZWBCX HOQCFFAOX ROYXANO EMDMZMTS 


R 
0 
N 
I 
S 
SWITCHBOARD NO COMMUNICATION AFTER TEN 
TZFVUEAORSL AU PADDERXPNBXAR IGHFX JXI 
e (1) In the foregomg illustration the steps are particularly Blllple because of the followmg 


Cll'Cumstances 


(a) The actual word lengths are shown 
(b) The words are enciphered monoalphabetically by different alphabets belongmg to a 
set of secondary alphabets 
(c) Repetitions of plam-text words, enciphered by dt1ferent alphabets, produce 1S0morphs 


and the lengths of the 1Somorphs are definitely known as a result of cJ.rCumstance (a) 
(2) Of these facts, the last is of most mterest m the present connection 
But what If the 
actual word lengths are now shown, that lB, what If the text to be solved is mtercepted m the 
usual 5-letter-group form? 


1811122-89--2 


SECTION IV 


SOLU'l'ION OP sr:rii~:.~~~~';'~:=~i:i::gs~~TS TO ENCIPHER 


General remarks 
____ __ _ _ 
Paragraph 


Word separators __ 
_ 
- 
------ - - -- -- -- _ ___ 
_ ___ 
14 


V~iat1ons and concludmg re~~;k; ~~-;.~;g~ing ~y~tf'ms - 
- ---- ----- 
--- -- --- --- 
15 


14. General remarks -a The (,a<>es de.-,t.nbed th 
f 
---- -- - -- - - ------ -----------------· ·- --- 
16 


the cryptanalyst has before hun th 
l us a1 aie piu ticulaily easy to solv-e because 


military cryptography this is seldon: =~:~~~st~ tie.tr true or ongmaI word lengths 
But in 


what more difficult by ieason of the fact that tli'c;e~:S~ot~e problem is therefore made some- 
encipherment by successive keyletters 
However th 
1 g to mdzcate defuntely the lumts of 


pe.runentation m tlus case than m the pre d 
, The so ut1on merely necessitates more ex- 
repetitions which may serve to "block out"c:r ~;lumt e c:;ptanalyst must take careful note of 
will be able to fwd and identJ.fy certain 
h wor 8• and hope that when this is done he 


terns, such a.s those noted above 
If ther:~q;;inc;s f~vmg fanul1ax id1omo1p1uc features or pat- 


to permit of employmg tlus ente:rmg wedges 
en yo ext, repetition-, Wlll be sufficient m number 


h Of course, zf any sort of stereotypic pluas 1 
l 
or endings of the messages, the matte1 of assum eo Og) is emp oyed, especially at the begmnmgs 
and affords a qmck solution 
For example su mg v~ues for sequences of cipher letters is easy, 
found that many messages begm with t' , 
ppose 
at as a result of previous '\\-ork it has been 


Having several messages for study, the n:1:~~1~~m;: o~ERRING TO YOUR NUMBER 
idiomorphzsm as that given by the '11-ord REFER 
e wluch begins with such a common 
found the word REFERRING if witli a f 
d 
RiiG 18 a relatively sunple matter, and havin1r 
NUMBER, the solution is probably well u::er ';:;e o certainty one C'ft.ll ndd the words TO YOUR 
c (1) Take the case discussed m para a h 13 b 
mcb.cated because the message is transm~e: 
'th ut ass~melthat word lengths are no longer 
ascertammg the exact length of sequen 
h mh 
e usu 
5- etter groups 
The process of 
te 
d "bl 
ces w le are isomorplur or 
th 
rme ' 
ockmg out isomorphs" b 
, 
' as 
e process lB bnefly 


rather tenuous threads of reasomng eco;es a more dllficult matter and must often rest upon 
with and let it be assumed that it was arran;::1:-f~:~~~~:u~~e illustrative message Just dealt 


VCLLK 
IDVSJ 
DCIOR 
KDCFS 
UEVZZ 
FKNAK 
FORAD 
KOMPI 
TVIXH 


LZKSQ 
LPROJ 
ZWBCX 
HOQCF 
SECSP 
OEMDM 
ZMTST 
ZFVUE 
AORSL 
FAOXR 
NBXAR 
IGHFX JXI 
AUPAD 


MP PF X 
PHQKC 
OYXAN 
DERXP 


(2) The detection of isomorplusms n 
b 


special trouble m pickmg out the foll 
otwh 
ecomes a more cb.fficult Inatter 
There IS no 
owmg 
1 ee isomorphic sequences 


{1) V C L L K I D V S J D C I 
(g) C S P P H Q K C L Z K S Q 


(~) p A D D E R X P N B X A R 


(14) 


smce the first one happens to be at the begmnmg of the message and its left-hand boundary, or 


11head," is marked by (or rather, coIDcides with) the begmrung of the message 
By a fortunate 


circumstance, the nght-hand boundary, or "tail," can be fixed Just as accurately 
That the 


repetition extends as fa.r as mdu,ated above is certam for we have a check on the le.st column 
I, Q, R 
If an add1t1onal column~ ere added, the letters would be 0. L, I 
Smee the second 


letter has previously appeared while the first and thll'd have not, a contrad1ction results and the 
new column may not be mcluded 
If, ho'\\-ever, none of the three letters 0, L, I had previously appeared, so that there could 
be no means of gettmg a check on their < orrectness, it would not be possible to block out or 
ascertam the extent of the isomorphism m surh a case 
All that could be said would be that 
1t seems to mdude the first 13 letters, but it might continue further 


d (1) However, the dJ.fficulty or even the imposs1b1hty of blockmg out the lSomorphs to 
their full extent is not usually a serious matter 
After all, the cryptanalyst uses the phenomenon 
not to identify words but to obtam cryptanalytic data for reconstructing cipher alphabets 
For example, how many data are lost when the illustrative message of subparagraph 13a is 
rewntten m 5-letter groups as m subparagraph 14c (l)? Suppose the latter form of message 
be studied for isomorphs 


VCLLK 
IDVSJ 
DCIOR 
KDCFS 
TVIXH 
MPPFX 
UEVZZ 


FKNAK 
FORAD 
KOMPI 
SECSP 
PHQKC 
LZKSQ 
LPROJ 
ZWBCX 
HOQCF 
FAOXR 
OYXAN 
OEMDM 
ZMTST 
ZFVUE 
AORSL 
AUPAD 
DERXP 
NBXAR 
IGHFX JXI 


{2) If tl,e undersC'ored sequemes are compnred Mth those m the message m subparagraph 
13a, it will be found that only a relatively s.nall amount of mformat1on has been lost 
Certainly 


not enough to c,ausc uny d1fht ulty have been lo[,,t m tlus Lase, for all the data necessary for the 
reconstruction of t11e m1xe<l. cipher component came from the first set of isomorphs, and the 
latter are identiLal m length m both case<i 
Only the head and tatl letters of the second pau 


of 1somorplu<' sequences are not mcluded m the underscored sequences m the 5-letter vel'Sl-on 
of the message 
The third p<Ur of isomorphic sequenles shown m paragiaph 13b does not appea.r 
in the 5-letter version smce there 1S only one repeated letter m tlus case 
In long messages or 
when there are many short messages, a study ot isomorplusm will dlSclose a sufficient number of 
partial isomorphs to give data usually suffiuent for pu1poses of alphabet reconstruction 
e It should be noted that there is nothing about the phenomenon of isomorphism winch 


restncts its use to c,asesm '"Inch the upher alphabets are secondary alphabets resulting from 
the shdmg of a mixed component against the normal It can be useful m all cases of interrelated 
secondary alphabets no matter what the basis of thmr denvation may be 
f In subsequent studies the important role which the phenomenon of 1Somorplusm plays 


m cryptanalyt1cs wtll become more apparent 
When the traffic is stereotypic m character, 
even to a shght degree, so that 1Somorplusm may extend over several words or phrases, the 
phenomenon becomes of highest rmportance to the cryptanalyst and an extremely valuable tool 
m Ins hands 
15 Word seprrators --a One of the prn...,tlcal drfficult1es m employmg systems m which the 
keymg process shift<; accordmg to word lengths lS that m handhng such a message the decrypto- 
graplung clerk lS of ten not certam exactly when the termmat1on of a word has been reached, 
and thus ti.me is lost by hun 
For m .. tance, wlule decryptographmg a word such as INFORM 


the clerk would not know whether he now has the complete word and should shift to the next 
key letter or not The word rmght be INFORMS, INFORMED, INFORMING, INFORMAL, INFOR- 
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MATION, etc 
The past tense of verbs, the plural of nouns, and te.rmmat.zons of va.nous sorts 
capable of bemg added to word roots would give r1'3e to dlfficult1es, and the latter would be 
especially troublesome if the messages contamed a few telegraph.le enoni 
Consequently, a 
achem.e wluch is often adopted to circumvent this source of trouble is to md1cate the end of a 
word by an infrequent letter such as Q or X, and enClphenng the Ietta- 
In such usage these 
letters are called word separatora 
b When word separators are employed and this fact 1s once discovered, therr presence is 


of as much aid to the cryptanalyst m ms solution as 1t is to the c1erks who are to decryptograph 
the messages 
Sometunes the presence of these worcl separators, even when enciphered, aids 


or makes posSible the blockmg out of 1somorpbs 
16 Va.nations a.nd concluding remarks on foregoing systems -a The systems thus far 


descnbed are all based upon word-length enciphe1ment usmg different cipher alphabets 
Words 


a.re markedly irregular m regard to tlus feature of their construction, and thus aperiodicity JS 
mi.parted to such cryptograms 
But vB.l'latlons m tbe method, a.zmed at making the latter 
somewhat more secure, are poSSible 
Some of these vanat1ons will now be discussed 
b Instead of enc1phenng accordmg to natural word lengths, the irregular groupmgs of the 
text may be regulated by othel" agreements 
For e'.ample, suppose that the numeneal value 
(m the normal sequence) of ea< h key letter be used to control the number of letters enCiphered 
by the successive cipher alphabets 
Depencbng then upon the composltl.on of the key word or 
key phrase, there would be a varymg number of letters enciphered m each alphabet If the 
key word were PREPARE, for mstttnce, then the :first cipher alphabet would be used for 16 
(P= 16) letters, the second cipher alphabet, for 18 ( =R) letters, and so on 
Mono alphabetic 
e.ncipherm.ent would tha-efore allow plenty of opportunzty for tell-tale word patterns to mam.fest 
themselves m the cipher text 
Once an entenng wedge 1s found m tlus manner, solution would 
be achieved rather rapidly 
Of course, all types of Clpher alphabets may be employed m this 


and the somewhat smular schemes descnbed 


c H the key IS short, and the message IS long, penod.iCity will be manifested m the crypto- 


gram, so that 1t would be poSSible to ascertain the length of the basic cycle (m this case thelength 
of the key) despite the irregular groupmgs m enc1pherment 
The determmat1on of the length 
of the cycle might, however, prese.nt difficulties m some cases, smce the basic or fundamental 
penod would not be cles.rly evident because of the presence of repetitions which are not penodic 
m their ongm 
For example, suppose the word PREPARE were used as a key, each koy letter 
bemg employed to enczph.er a number of letters correspond.mg to its numenca.I value Jn the 
normal sequence It l8 clear that the length of the basic period, m terms of letters, would here 
be the sum of the numencal values of P {=16)+R (=18) + E (=lJ), and so on, totalling 79 
letters 
But because the key itself contams repeated lettexs and because enc1pherment by each 
key letter IS monoalphabetlC there would be plenty of cases Jn wluch the first letter P would 
enCipher the same or part of the same word as the second letter P, producmg repetitions m the 
cryptogram 
The same would be true as regards encipherments by the two R•s and the two 


E•s m this key word 
Consequently, the basic penod of 79 would be distorted or masked by 


apenod.ic repetitions, the intervals between wluch would not be a function of, nor bear any 
relatron to, the length of the key 
The student wtll encounter more cases of tlus kmd, m which 
a fundamental penodtCJty is masked or obscured by the presence of Clpher-text repetitions not 
attributable to the fundamental cycle 
The <1xperzenced cryptanalyst lS on the lookout for 


phenomena of this type, when he finds m a polyalphabetic cipher plenty of repetitions but with 
no factorable constancy wluch leads to the dlbc1osure of a short period 
He may conclude, then, 


either that the cryptogram mvolv68 severnl pnmary periods which interact to produce a long 
resultant penod, or that 1t involves a fEU.rly long fundamental cycle Witlun which repetitions of a 


• l 
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.l. 
.. .. e present and obseure the phenomena manifested by Npetltlons of a penodlc 
nonpenow.c origin ..... 
origm 
f 
l al habetic enc1phermsnt of v81'labla-length 


d (1) A logical extension of the principle 0 )a!-t:xt groupmgs rarely exceed 4 letters, so 
plam-text groupmgs IS the case m wluch these p 
sh rt time thus brea.kmg up what nught 


that a given cipher alphabet is in play for onl~: :1eZer t~xt 
F~r example, suppose the letters 


othel'WlSe appear as fairly long repetltt~-~ 
~ order were set oft mto four groups, as 


of the alpbabet, 9.l'l'anged m theu nornuu- requen 
, 


follows 
H F U p M y G 
W V B X K Q J z 
ETRIN 
OASDLC 
Groups 
Group4 
Group l 
Group 2 


hat one letter will be ene1pha-ed, a letter m 
(2) Suppose that a letter m group 1 means t 
S 
ose. next th.at a rather lengthy 


group 2, that two letters will be enciphered, a~~ 
0~d'P~ 'orRECTION OF THE CHIEF 


phrs.se were used as a key, for example, PREP 
ION COURSES 
Suppose, finally, that each 
SIGNAL OFFICER FOR US!!! WITH ARMY EX'l'ENS ueular cipher alphabet to be used, but also 
letta- of the key were used not only t~ select ~:~s.rby the selected alphabet, o.ccordmg to the 
to control the number of letters to e encip 
b 
the H'.CDP.AULIC 
XZ prunary 
scheme outhned above 
Such an enc1phe::i se =e~=nent, would yJ.eld the follo'Wlng 
cipher component shdmg agamst the no 
p 


groupings 
1 1 
3 
1 2 
3113 2112 3121 


Grouping-------------------- 
R E 
p 
A R E D 
U N D :E R T 
H E D 


KeY----------·---------------- 
p R S T DIV IS I 0 NW ILL A DV A N C EA'l' F IV 


Plam------------------------- FI T R THJ GV F X MX JNN N UW E N W AHQ \\ EW 
CJ.pher.-------------·-"·----- WHB 
2 
3 
l 
111211212 3 13 1 


GrouplD.g-------------------- 
R E C T I 
0 N 0 
F 
T 
H E C 
H 
I 


Key·-------------------------- I 
FT E E NA M AS SEC 0 NDD I VI SIO N 


Plam---·---------------------- E ~ ~ JY z F AO D OB RMJ B JRR p RN PCK S 
CJ.pher----------------------·· F 
f 
the formation of lengthy repetitions would 
(3) Here it will be seen that any tend:cy u1~~ sh1ftmg of alphabets 
The fust tune the 
be eounterncted by the short groupings ~civFXM the second tlme it occurs it 18 enciphered 
word DIVISION occurs it is enciphered as 
•h red by exactly the same sequence of key 
as RPRNPCKS 
Before DIVISION can be twice en~p e 
between the two occurrences of the 


letters an mterval of at lenst 140 letters must m ene: -140) and then the chances that 
word (the sum of the Vll.lues of the letters of thef ~7vp ea~:-; one :.U three Only one of these 
the key letter p would begm the enmpherm~~ o the sa~e sequence of c1pha- eqmvalents the 
three possible enc1pherments will yield exa FY 
le if the text "ere such as to place two 


second time as was obtained the fust time 
or e"Camh , 
below their enc1pherments would 
occurrences of the word DIVISION m the po1>itions s own 
' 


be as follows 


3113 
2112 


p 
RE p 
A RED 
FIR s T DIV IS I 0 N 


THJ GV F X 'M 


a 
1 
1 


P RE 
3 
1 


U N 


ll 
' 
l 
1 
2 


p 
A RE D 
DI VI S I ON 
TH ZG T PNM 


I 
1 


U N 
. . . 
. . . . 
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Although the word DIVIS!ON, on its second a 
where it begins on its first appearance th 
ppearance, begins but one letter beyond the place 


letten, the fourth, and the last letters' 
;h~;her eqmvalents now agree only m the first two 


D I V I S I 0 N 
(1) .I...li J 5J V F X M 
(2} !Ji z ri T p N M 


e Attention is directed to the charactenstics f 
- 
same word 
When they a.re supenm osed 
o the foreg01ng two onc1pherments of the 
two enc1phcrments, then there is a !m 1 ' t~e first two cipher eqmvalcnts are the same m 
the 


I 
the next c1pher eqwvalent JS the same ~=n 
U:o~rvalt~~ere the cipher equivalents are different 


ents tirtl.1.lly th l t 
h 
' 
OVI- 
~u~e mtervals with d 
I 
h 
' 
, 
' 
e as mp er eqwvalent IS the sam 
1ss1m1 ar cip er eqmva- 
only to one or two letters, longer repetitions 
em bo::;- cases 
The repet1t1ons here extend 
ments yield only occasional coincidenceB tha can occur o y exceptionally 
TI1e two encipher- 
moreover, the duml>ution of the c01nc1d;nce t is, p:;ces where the cipher letters are identical 


f Tins phenomenon of intermittent coi:~w lI'regular and of an mterllllttentcharacter' 
ptW'S of letters, or short sequences (rarel 
nces, Involving comcidences of smgle letters 


lBtJcs of tlus general class of polyalphab~:;:i~:~~~dmg pcntagraphc;) is one of the character~ 
mamfest whs.t appears to be a disturbed or distorted tzon, ;herem the cryptograms commonly 
g From a. techrucal standpomt the 
peno iczty 
system ls based has much ment but'fo 
ci;pt~graplue prmc,1ple upon wluch the foregoing 


to enor 
However, if the enCiphermen: :rac ica h usage it is entirely too slow and too subiect 


key were qwte lengthy, such a system and ::c::t' amzed by maclunery, and if the enc1phenng 
m11.ehmes for accomphslnng this type of subst1t msm becomes of practical importance 
Cipher 


ution will be treated m o. subsequent text 


SECTION V 


SOLUTION OF SYSTEMS USING VARIABLE·LENGTH KEYING UNITS TO ENCIPHEB. 
CONSTANT·LENGTH PLAIN-TEXT GROUPINGS 


Va.r1able-lel'gth groupmgs of the J.eymg sequence_ _ _ _ ___ _ 
Methods of mtuiuptrng a cyclic ":eying sequence __ 
Interruptor is a plam-text letter 
__ _ _ 
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Concludmg remarks 
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Paragiapll 
--- ----- ------------- 
17 
---- - -- - --- ------ 
18 
- - -- - ---- -- --- -------- 
1 \) 
-- 
... --- .. 
- 
............ __ .. - ................................................ ... 
- 
....... - .. ..... 
---- ---- .......... ........ 
... ......... ~ 
- ............. -- ............ -- -·------ _ ... _ _ __ .., ________ .., __ .. 
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17 Va.r1a.ble~length groupmgs of the keying sequence -The precedmg cases deal with 
simple wethods of chmmatmg or J.voidmg penod1c1ty by t-ll<.'lp{lerm~ varlfl,ble-length groupings 
of the pl.im te'\.t, 11'>1ng conc;ttmt-length hPymg \lmtc; 
In p•trttgraph 2a, however, it was pomted 
out that pcrwduity can also be supprpc;sed by '1pplymg variable-length key groupmgs to con- 
stant-length plo.1r>-tC''\t groups 
One such method conc;1sts m irregularly 'llnterr?J,ptvng the keymg 
seq_uen<.'e, if the latter is of n lmnted or fiwd length, anll rec,omme11C'mg it (from its m1t1al pomt) 
after surh mtr1rupho11, c;o thJ.t the keymg sequen<'e bernmcc; c-qmvalent to a sanes of keys of 
different lengths 
'l'hm,, the> l~ey pln af:.e BUSINESS MACHINES may be expanded to a senei:. of 


irregular-length keymg sequencei:., such as BUSI/BUSINE/BU/BUSINESSM/BUSINESSMAC, etc 
Vanous schemes or prearrangements for mdicatmg or deterrrumng the mterrupt10ns may be 
adopted 
Tl,ree methods will be ment1onrd m the next 11u.ragraph 


18 Methods of mterruptmg a. cycllc keying sequence -a. Thorn 8.le many methods of 
mterruptmg a. keymg c;equence wLlch 1s ba.sieally cyclic, and wluch therefore would give nse 
to penodicity ii not mterlered with m some way 
These methods may, however, be classified 


mto three categones as regards what happens after the mten upt1on occurs 


(1) The keymg sequence merely stops and begms a.ge.m at the m1t1al pomt of the cycle 
(2) One or more of the elements m the keymg sequence ma.y be onutted from time to trme 


irregularly 
(3) The keymg s<'quence irregula1ly alternate.,, in its direction of progression, with or 
without onus:::.ion of some of its element., 
b These methods may, for clarity, be represented grapluco.lly as follows 
Suppose the 
key consists ot a cychc sequence ( f 10 elements represented S) mbohcally by the sanes of numbers 
1, 2, 3, 
, 10 
U&mg an asteni,,k to md1cn.te nn mterrupt10n, the followmg may then represent 
the :relation 1etween the letter number of the message and the element number of the keymg 
ioequences m the three types mentioned above 


{ 


Letter No _______ --------- 
l 2 3 4. 
5 6 7 8 9 10 
11 12 13 
14. 15 16 17 18 19 20 


(l} Key element No_________ 
1-2-3-4-* -1-2-3-4-5- 6--*- 1- 2- 3_-1<_ 1- 2- 3- 4- 5- 6- 7-* 
Letter No------------------ 21 22 23 24 25 26 27 28 29 30 
31 32 33 
34 35 
Key element No_____ ___ 
1- 2- 3- 4- 5- 6- 7- 8- 9-10-*- 1- 2- 3-*- 1- 2- etc 


{ 


Letter No. _____ ----------- 
1 2 3 
4 5 6 7 8 9 
10 11 12 
13 14 15 16 17 18 19 20 


~ 
2 


) Key element No_________ 
1-2-3-*-7-8-9-10-1-2-*- 4- 5- 6-*- 3- 4- 5- 6- 7- 8- 9-10- 


Letter No------------------ 21 
22 23 24 25 26 
27 28 29 
30 31 32 
3'3 34 35 


Key element No- ------- 
1-*- 8- 9-10- 1- 2-*- 5- 6- 7-*- 9-10- 1-*- 5- 6- 7- etc 


(19) 


20 


{3)~e~e:ie~~t-N~~~~~~~::: :_:_:_:_:_._:_~_._:_:_ 1 
6° 11 12 13 14 15 
16 17 18 19 
20 


Letter N 
- 7- 8- 9-10- 1-*-10- 9- 8- 7-*- 8 
K 
I o __________________ 21 22 23 24 25 
26 27 28 29 30 
31 32 33 34 35 
eye ement No_________ 
9-10- 1- 2- 3-*-2- 1-10- 9- 8-* 9 10 
A 
- 
- 
- 1- 2- 3 etc 
s regard~ the tlurd method, wluch involves onl 
I 
of the keying sequence if there 
t 
y an a ternation in the direction of progression 
10-element keying seq~ence for ::r;,:: 
0 
1 m e~uptions m the key it would mean merely that a 
sequence and the matter co~Id then beph~~~ dd b~btrea~ed as though it were an 18-element 
method 
But if the principles of the seconde an~ ti:r~g It were a special form of the second 
the matter may become qmte complex 
method are combined m one system, 
c If one knou,s when the mterruptions take Ia 
h 
the basic keying cycle m the thre 
b 
P ce m eac cycle, then successive sections of 
e cases may e supenmposed 
Thus 


Keying element No __ 1 
METHOD (1) 
2 
3 
4 
5 
6 
7 
8 
9 
10 
Letter No ___ ------------- 1 
2 
3 
4 
Letter No_________________ 5 
6 
7 
8 
9 
10 I 
Letter No_________________ 11 
12 13 I 
Letter No _________________ 14 15 16 17 
18 19 
20 I 
Letter N 0----------------- 21 
22 23 24 25 
26 27 28 29 30 I 
Letter No_________________ 3 l 
32 33 I 
Letter No _________________ 34 35 etc 


Keying element No__ 1 


METHOD (2) 
2 
3 
4 
5 
6 
7 
8 
9 
10 
Letter No______ ___ ______ 1 
2 
3 I 
4 
5 
6 
7 
Letter No_________________ 8 
Letter No_________________ _ 
9 ,_ 
10 
11 
121 


- 
13 
14 
15 16 
17 18 
19 20 
Letter No _________________ 21 I _ _ 
22 23 
24 
Letter No_________________ 25 26 I _ 
27 28 291- 
30 31 
Letter No_________________ 32 I _ _ 
33 34 35 etc 


METHOD (3) 
Keying element No __ I 
2 
3 
4 
5 
6 
7 
8 
9 
Letter No________________ 11 ~2r~3~-:4i--i5~~--!-..2....!,._.;!l~O 
Letter No_________________ _ 
-1 7 
6 
Letter No._ ------------- _ 
8 
Letter No _________________ 15 I - 
Letter No _________________ 23 24 
Letter No _________________ 27 26 
Letter No_________________ 33 34 


251- 


35 etc 


9 
10 
11 
12 
-I 19 
18 
20 


- 
-130 


13 
14 
17 16 
21 
22 
29 28 
31 
32 


Obviously if one does not know when or ho 
h 


sections of keying elements cannot b 
w t e interruptions take place, then the succes81ve 


d The 
t 
f 
e supenmposed as md1cated above 
m erruption o the cychc keymg 
all 


prearranged plan, and the three basic meth d se1uence usu 
y takes place accordmg to some 
a short mnemomc key as an example 
0 s 0 mterruption will be taken up m turn, umng 
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e Suppose the correspondents agree that the mterruption m the keymg sequence will take 
place after the occurrence of a specified letter called an interruptor,1 winch may be a letter of the 
plam text, or one of the cipher text, as agreed upon m advance 
Then, smce m either case 
there 18 nothmg fixed about the time the mterrupt10n will occur-it will take place at no fixed 
mtervals-not only does the mterruption become qwte irregular, followmg no pattern, but also 
the method never reverts to one having penodlc1ty 
Methods of tlus type will now be discussed 
m detail 


19. Interruptor is a pla.m-text letter -a Suppose the correspondents agree that the mter- 


ruption m the key will take place immediately after a previously agreed-upon letter, say R, 
occurs m the plam text 
The key would then be mterrupted as shown m the followmg example 


(usmg the mnemomc key BUSINESS MACHINES and the HYDRAULIC 
XZ sequence) 
Key ______________ B U S I N E S S M A C H I B U S B U S I B U S I N E 
Plam_____________ A M M U N I T I 0 N F 0 R F I R S T A R T I L L E R 
Cipher___________ B 0 L Y R P J D R 0 J K X K J F Y X S X D J U P S Y 


Key______________ B u s I N E s s M A c H I N E s B u B u s I N E s ·s M A c H I 
Plam_____________ Y W I L L B E L 0 A D E D A F T E R A M M U N I T I 0 N F 0 R 
Cipher ___________ I Y D P Y F X U R A F A E N M J J V B 0 L Y R P J D R 0 J K X 


Key ______________ B U S I B U S B U S I N E B U S I N 
Pla.m_____________ T H I R D A R T I L L E R Y 
Cipher___________ D G D X G U F D J U P S Y I 


B 0 LY R 
YFXUR 
XGUFD 


P JD R 0 
AF A EN 
Ju p s y 


CRYPTOGRAM 


J K X K J 
F Y X S X 
:.D__,J:......:U--'P:......:::S..._...:Y=--=I Y D P 
M J J V =B-'"""O"-=L-'Y-...-R---.P_..-J""""D---.-R"""-"'O_J;:;..._ ......... 
K-=X D G D 
IX XX X 


b Instead of employmg an ordmary pla.m-text letter as the mtemiptor, one might reserve 
the letter J for this purpose (and use the letter I whenever tins letter appears as part of a plam- 
text word) 
ThIS is a qmte Simple vs.nation of the ha.Sic method 
The letter J acts merely 


as though it were a plam-text letter, except that m tins case it also serves as the mterruptor 
The mterruptor 18 then mserted at random, at the whrm of the enciphermg clerk 
Thus 


Key_________ B U S I N E S S M A C I B U S I N E S S M I B U S I N E S S M A C H I N E S B U S I N 
Plam________ T R 0 0 P S W I L L J 
B E H A L T E D J 
A T R 0 A D I U N C T I 0 N F I V E S I X 


c It is obvious that repetitions would be plentiful m cryptograms of thIS construction, 


regardless of whether a letter of lugh, medium, or low frequency is selerted as the signal for key 
mterrupt1on If a letter of high frequency is chosen, repetitions will occur qmte often, not 
only because that letter will certamly be a part of many common wordci, but also because it will 
be followed by words that are frequently repeated, and mnce the key starts agam with ea.ch 
such mterruption, these frequently repeated words will be enciphered by the same sequence of 
alpha.bets 
Tins is the case m the first of the two foregomg examples 
It is clear, for mstance, 
that every time the word ARTILLERY appears m the cryptogram the cipher eqmvalents of 
TILLERY must be the same If the mterruptor letter were Ap mstead of Rp, the repetition 


1 Also called at times an "m11uence" letter because it mfluences or modifies normal procedure 
In some 
caaea no 1n1luence or mterruptor letter 1s used, the mterrupt1on or break m the keymg sequence occumng after 
a previoualy-agreed-upon number of letters has been enciphered 
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would mclude the Cipher eqmvalents of RTILLERY, if it were Tp, ILLERY, and so on 
On the 
other hand, Jf a letter of low frequen<'y were sele<'ted as the mterruptor letter, then the enr1pher- 
ment would tend to approxunate that of normal repeatmg-key subst1tut1on, and repet1t1ons 
would be plentiful on that basis alone 
d Of course, the lengths of the mtervals between the repetit10ns, m any of the foregomg 
cases, would be irregular, so that penod1c ity would not be manifested 
The student may 
mqmre, therefore, how one would proceed to c:;olve suC'h messages, for it is obvious that an 
attempt to allocate the letters of a smgle message mto separate monoalphabetic distnbutions 
Lannot be successful unless the exaC't locat10ns of the mterrupt10ns are known-and thev do 
not become known to the cryptanalyst until he has solved the message, or at least a part of it 
Thus it would appear as though the would-be solver Is ht're C'onfronted with a more or less msoluble 
dilemma 
Th.ls sort of reasonmg, however, makec; more of an appeal to the novice m cryptog- 


raphy than to the experienced cryptanalyst, who spe<'iahzes m methods of solvmg cryptographic 
dilemmas 
e (1) The problem here will be attacked upon the usual two hypotheses, and the easier 


one wtll be discussed first 
Suppose the system hns been m use for some time, that an ongmaJ 
solution has been reached by means to be dISLUSbed under the <>econd hypothesis, and that the 
cipher alphabets are known 
There remams Pnknown only the spemfk key to messages 
Exam- 


mmg whatever repet1t1ons are found, an attaLk is made on the basib of searchmg for a prnbable 
word 
Thus, takmg the illustrative mebbage m bnbparagraph a, suppose tl.e p1esence of the 
word ARTILLERY lS suspected 
Attempts are made to locate this word, },asmg the search 
upon the construction of an mtelhgi.ble key 
Begmnmg with the very first letter of the message, 
the word ARTILLERY lS Juxtaposed agamst the opher text, and the key letters ascertamed, 
U"lmg the known alphabets, w.hlc h we will 8.b'>Ume m thib case are bused upon the HYDRAULIC 
XZ sequence shdmg agamst the normal 
Thu<> 


Cipher 
---- _ -- 
_ B 0 L Y R P J D R 


Plam..___ --- ------- --- A R T I L L E R Y 
"Key"-------- -- --- --- B H J Q P I B F U 


(2) Sm<'e this "key" 1s rertamly not mtelhgible text, the assumed word 1s moved one letter 
to the nght and the test repeated, and so on unttl the followmg place m the test 1s reached 


Cipher_____ _ -- _____ S X D J U P S Y I 
Plam____________________ A R T I L L E R Y 
Key_ -- ---------- _ _ S I B U S I N E B 


(~) The sequence BUSINE suggests BUSINESS, moreover, it is noted that the key 1c; m- 
terrnpted both times by the letter RP 
Now the key may be applied to the begmmng of the 
message, to see if the whole key or only a portion of it has been recovered 
Thus 


Key _____________________ B U S I N E S S B U S 
Cipher __________________ B 0 L Y R P J D R 0 J 
Phun ____________________ A M M U N I T I U M T 


(4) It is obvious that BUSINESS is only a pait of the key 
But the deciphered sequence 
certamly seems to be the word AMMUNITION 
When t.hls is tned, the key ls extended to 


BUSINESS MA 
Enough has been shown to clanfy the procedure 
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j The foregomg solution 1s predicated upon the hypothesis that the cipher alphabets are 
known 
But what if th.ls is not the c&be? What of the steps necessary to arnve at the first 


solution, before even the presence of an mterruptor is suspected? The answer to thls que"ltion 
leads to the presentation of a method of attack "hlch is one of the most nnportant and powerful 
means the cryptanalyst has at his command for unravelmg many knotty problems 
It lS called 


solution by superimposition, and warrants detailed treatment 


20. Solution by super1mnos,t1on - 
a 
Basu: principles - 
(1) In solvmg an ordmary 
repeatmg-key cipher the fin.L ..+pp, that of asrertemmg the leng-th of the penocl, is of no s1gmh- 
c an<'e m itself 
It merely paves the wny for and makes possible the second step, which consists 
m allocatmg the letters of the cryptogram mto mdividual monoalphabetic distributions 
The 


third step then consi"lts m solvmg these d1str1buhons 
Ubually, the text of the message is trans- 


cnbed mto its penoas and is wntten out m ciurC'essive hnes correspondmg m length with that 
of the penod 
The diagram then consists of u series of columns of letters and the letters m eaC'h 


column belong to the same monoalphabet 
Anothei v. ay of loolang at the matter is to conc.e1ve 


of the text as havmg thus been t1anscnbed mto superimposed perwds m such case the letters m 
each column have undergo"le the same kmd of t1cntment by the same elements (plam nnd cipher 
components of the cipher alphabet) 
(2) Suppose, however, that the repetitive key is very long and that the message is short, so 
that there are only a very few cycles m the text 
Then the solution of the message becomes 
difficult, 1f not nnpossible, because the1e 18 not a su:fficrnnt number of supenmposable penods to 
yield monoalphabetlc distnbutions which can be solved by frequency prm::1ples 
But suppose 
also that there are many short cryptogrJ.ms all en~1phered by the same key 
Then it is clear 
that if these messages are bUpenmposed 


(a) The letters m the respective columns will all belong to md1vidual alphnbetc:;, and 
(b) If there is a o;ufh<'lent number of c;;ur h super1wp<'c;;ablE> wc>c;;c;;ages (c;;ay 25-30, for F.n~hsh), 


then the froquenLy distributions applicable to the suCl ess1ve columns of text can be solved- 
'1.V1Jhout knowing the length of the key 
In other words, any chfficulties that may have ansen on 
account of failure or mabtl1ty to ac:;certam the length of the penod have been crrcumvented 
The second step m normal solut10n ls thus "by-passed " 


(3) Furthermore, and th.ls IS a ve1y IIL.portant pomt, m case an extremely long key is em- 
ployed 8.l'd a senes of mesc;ages begmnmg at different nnt1al pomts are enciphered by buch a key, 
th.ls method of solution by supenmpoS1t1on can be employed, proVIded the messages can be o;uper- 
nnposed correctly, that is, so that the letters wluch fall m one column really belong to one cipher 
alphabet 
Just how th.ls can be done will be demonstrated m subsequent paragraphs, but a 


clue has already been given m paragraph 18c 
At th.ls pomt, however, a Slillple illustration of 
the method will be gi.ve11, usmg the subst1tut1on system discussed m paragraph 19 
b Example-(1) A set of 35 messages has been mtercepted on the same day 
Preswnably 
they are all m the same key, and the presence of repet1t10ns between rr.essages corroborates th.lb 
assumpt10n 
But the mtervals between repet1t10nc; withm the same message do not show any 
common factor and the messages appear to be apeuodic m nature 
The probable-word methorl 
has been apphed, usmg standard alphabets, with no success 
The messages are then super- 
rmposed (Fig 5), the frequency d1stnbut1ons for the first 10 columns are as shown m Figure 6 


1 
2 
3 
4 
5 
6 
7 
8 
9 


10 
11 
12 
13 
14 
15 
16 
17 
18 
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ZCTPZWZPEPZQX 
19 
A F E 0 J T D T I T 
WTEQMXZSYSPRC 
20 KPVFQWPKTEV 
TCRWCXTBHH 
21 
ZABGRTXPUQX 
EFKCSZRIHA 
22 
YHEOCUHMDT 
YANCIHZNUW 
23 
C L C P Z I K 0 T H 
VZIETIRRGX 
24 AFLWWZQMDT 
HCQICKGUON 
25 ZCWAPMBSAWL 
ZCFCLXRKQW 
26 HFLMHRZNAPECE 
HWWPTEWCIMJS 
27 CLZGEMKZTO 
E P D 0 Z C L I K S J 
28 TPYFKOTIZUH 
WTSSQZPZIET 
29 ZCCPSNEOPHDYL 
ZCGGYFCSBG 
30 
C I Y G I F T S Y T L E 
CWZAOOEMHWTP 
31 
YTSVWVDGHPGUZ 
C I Y G I F B D T V X 
32 
N 0 C A I F B J B L G H Y 
EAQDRDNSRCAPDT 
33 ZXXFLFEGJL 
YFWCQQBZCWC 
34 
Z C T M M B Z J 0 0 
WTEZQSKUHC 
35 HCQIWSYSBPHCZV 
ZCVXQZKZYDWLK 


FlGUBll ll 


::::: 
::::: 
~ 
~ 
~ 
~ 
~ 
~ 
~ 
~~~~~ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
~ 
~ 
~ 
~ 
~~ 
~ 
~~ 
~ 
~~ 
~ 
2. A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~~~~~~ - 
~~ 
~ 
~~~~ ~~~~~ 
3. A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~ 
~~~~~ 
~ 
~ 
~~~ 
~ 
~~~ 
~ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


~ 
~ 
~~~~~~ ~~~~~~ 
~ 
~~ 
5. 
A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~~~~~ ~~ 
~ 
~~~ ~~~~~~~~ 
~ 


6. 
A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~~~~ ~~ 
~~ 
~ 
~~~ 
~ 
~~~~ 
7. A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~ 
~~~ 
~~~~ ~~~~ 
~ 


8. 
A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~~~~~ ~~~~~ 
~~,~ ~~ 
~~ 
9. A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


~ 
~~~ 
~~ 
~~~~~~ ~~~~~~ 
10 
A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


FIGUBll G 
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(2) The 1st and 2d distnbutions are certamly monoalphabetic 
There are very marked 
crests and troughs, and the number of blanks (14) is more than satisfactory m both cases 
(Let 
the student at this pomt refer to Par 14 and Chart 5 of Military CryptanalySlS, Part I) But 
the 3d, 4th, and remammg distributions appear no longer to be monoalphabetic 
Note particu- 


larly the dIStnbution for the 6th column 
From this fact the concluSion is drawn that some 


disturbance m penodicity has been mtroduced m the cryptograms 
In other words, although 
they all start out with the same alphabet, some sort of mterrupt1on takes place so as to suppress 
penodicity 


(3) However, a start on solution may be made by attackmg the first two distnbutions, 


frequency studies bemg aided by consideratlC'rs based upon probable words 
In thIS case, Slllce 


the text compnses only the begmnmgs of messages, assumptions for probable words are more 
eaSily made than when words are sought m the mtenors of messages 
Such common mtro- 
ductory words as REQUEST, REFER, ENEMY, WHAT, WHEN, IN, SEND, etc, are good ones 
to assume 
Furthermore, high-frequency digraphs used as the rmtial digraphs of common 
words will, of course, mamfest themselves m the first two columns 
The greatest &J.d m th1S 


process is, as usual, a famihanty with the "word habits" of the enemy 
(4) Let the student try to solve the messages 
In so domg he will more or less qwckly find 
the cause of the rapid fallmg off m monoalphabeticity as the columns progress to the nght from 
the rmtial pomt of the messages 


21 Interruptor is a cipher-text letter -a In the precedmg case a. plain-text letter serves 


as the mterruptor 
But now suppose the correspondents agree that the mterruption m the key 


will take place immediately after a preVIously-agreed-upon letter, say Q, occurs m the cipher 
text 
The key would then be mterrupted as shown m the followmg example 


Key__________________ B U S I N E S S M A C H I N E S B U S I N E S S M 
Plam_________________ A M M U N I T I 0 N F 0 R F I R S T A R T I L L E 
Cipher _______________ B 0 L Y R P J D R 0 J K X T P F Y X S X B P U U Q 


Key __________________ B U S I N E S S M A C H I N B U S I N E S S M A C H B U 
Plam_________________ R Y W I L L B E L 0 A D E D A F T E R A M M U N I T I 0 
Cipher_______________ H R N M Y T T X H P C R F Q B E J F I E L L B 0 N Q 0 'Q 
Key __________________ B U S I N E S S M A C H B U S I N E 
Plam_________________ N F 0 R T H I R D A R T I L L E R Y 
Cipher _______________ V E C X B 0 D F P A Z Q 0 N U F I C 


B 0 LY R 
TTXHP 
F P A Z .Q 


P JD R 0 
CR F QB 
QNUFI 


CRYPTOGRAM: 


JKXTP 
E J FIE 
cxxxx 


FYXSX 
LLB 0 N 
- 


BPUUQ 
.Q_Q Q V E 
HRNMY 
C X B 0 D 


b In the foregomg example, there are no Siglllficant repetitions 
Such as do occur compnse 
only digraphs, one of which IS purely accidental 
But the absence of sigru:ficant, long repetitions 
IS itself purely accidental, for had the mterruptor letter been a letter other than Qo, then the 
phrase AMMUNITION FOR, which occurs twice, might have been enciphered identically both 
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tunes If a short key is employe<l, repetitions may be plent.iful 
lt'or example, note the fol- 
lowmg, m which S0 is the mterruptor letter 


Key _____ --------------- BAND SB A ND S BANDS BAND SB AN BA ND S BANDS B 
Plum ------------ ----- F R 0 M F 0 U R F I V E T 0 F 0 U R F I F T E E N A M B A R R A G E 
Cipher __________________ KT AK Z W XI ID AC B NZ W XI ID KW S J ON KT BT ID HJ 


c This last example gives a clue to one method of attaC'kmg this type of system 
There 


wtll be repetitions w1tlnn shozt seC'tirns, and t1'e mterval between tl'em w111 sometrmes permit 
or aqcei t.11nmg tl1e leTtgth 0f the kev 
In SU< h ">h< 1 t set t1onq, tl.e letters winch mtervene between 


thP repeat~d sequences may be ehmrnated a'I possible rnterruptor letten. 
Thus, the letters 
A, C, B, an<• N nmy be el.nunated, m the foregomg PAample, as mterruptor letters 
By extension 


of tlus prmc1ple to the letters mtervenmg between other repet1t10n'I, one may more or less 
qmc kly as<A'rtam what letter serves as the mterruptor 
d On .... e the mteuuptor lette1 has been foun<l, the neAt step is to break up the message 
mto "11nmtcrrupted" seq11ences aucl then attempt a <>olut10n by superimposition 
The prm- 


c1ples explumed m paia~raph 20 neeJ only be n1od.i.fieJ m mmoz respect'! 
In the fi.rbt place m 
this case the wlumnb of text formC'd by the supeumpos1tion of urunterrupted sequences ~ill 
be pmely rionoalp11abetic, "hereas m the rnsc of the e"i:ample m paiagraph 20, onlJ- the very 
first column is pu.1ely monoalphabetic, the monoalpliabet1c1ty falling off very iapHlly with the 
2d, 3d, 
columns 
Henrn, m tlns case the analySls of the mdrnclual alphabets sho11ld be 
an easier task 
But this v. ould be counterbalanced by the fact that "'1'ereas m the former case 
the cryptanalyst is dealmg with the n11t1al \\'ords of messages, m tins C'ase he is dealing with 
mtenor pm t10ns of tl.e te'\.t and has no v. ay of lmov. m~ where a word begms 
The latter remarks 


naturally no not apply to the Cabe whe1e a "'hole set of messages in tlus system, all m the same 
key, can be sub1ected to srmultaPeous study 
In buch a c,ase the (ryptanalyst would also have 
the imtrnl words to work upon 
22 Concluding reme.1ki. -a The prec,edmg tv.o parag.aphs both deal \\'Ith th<' first an1' 
simplest of the three bas1<' < ases ref erred to under paragraph 18 
The second of those case ... 
involves rnuqideiably more work m solution for the zeason that when the mterruption take;; 
place and the keymg sequence recommences, the latter is not mvanably the nntial pomt of the 
sequence, as m the first case 
b In the second of those C'aseb the mterruptor causes a break m tho keymg sequence an<l 


a recommcmement at any one of the 10 keymg elements 
Consequently, it is impossible now 
merely to superrmpose sections of the text by shiftmg thl'm so t1at their imtutl letters fall m 
the same column 
But a superimposition IS nevertheless possible provided the mterruptions 
do not occur so frequently 2 that sections of only a very few lette:S are enmphered by sequent 
keyletters 
In order to accomphsh a proper supenmpos1t10n m th.is case, a statistical test 


is essential, and for th.Is a good many letters are reqmred 
The nature of this test wtll be 
explamed m Section XI 
c The same tlnng IS true of the last of the three c,ases mentioned under paragraph 18 
The solution of a case of tlns sort is admittedly a rather difficult matter which will be taken up 
m its proper place later 
d (1) In the cases thus far studied, either the plam-text groupmgs were vanable m length 
and were enciphered by a constant-length key, or the plam-te"i:t groupmgs were constant ID 


2 When no interrupter or "mfiucnce letter" i~ used, the interruption or break in the keymg sequence occurs 
after the enc1phc.rment of a definite number of letters 
Once thls number has bt-en a.scertamcd <Jolution of 
subsequent messages is very simple 
' 
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length and were enciphered by a vanable-length key 
It is posSlble, however, to combIDe both 
prmc 1ples and to apply a van able-length key to vanable-length groupmgs of the plam text 
(2) Suppose the corre8pondents agree to encipher a message accordmg to word lengths, but 
at irregular mtervals, to add at the end of a word an mteuuptor letter which wtll serve to mter- 
rupt the key 
Note the followmg, m wlud1 the key is BUSINESS MACHINES and the mterruptor 
letter lS X 


Key____ ______ 
B 


Plam_____ _ __ A M M U N I T I 0 N 
Cipher ________ B T T R V 0 D 0 W V 


u 
F 0 R 
E Q V 


S 
B 
F I R S T X A R T I L L E R Y etc 
Z D F G J 0 B H D 0 S S J H I 


CRYP roGRAM 


BTTRV 
0 D 0 WV 
EQVZD 
FGJOB 
HDOSS 
JHI 
etc 


(3) The foregomg system is only a nnnor mod1fkat10n of tne simple case of ordmary word 
length enc1pherment as eJi..plamed m Section II If standard cipher alphabets are used, the 
spasmodic interruption and the presence of the mterruptor letter would cause no difficulty 
whatever, smce the solution can be a<.hieve<l mec,harucally, by completmg the plam-component 
sequenc,e 
If nuxed cipher alphabets are used, and the pumary components are unknown, 


solution may be reached by following the procedme outlmed m Sections II and Ill, with such 
modifications aq are suitable to the <.a&e 


e It IS hardly necessary to pomt out that the foregomg typeb of apenodlc substitution are 
rather unsuitable for practical rruhtary usage 
Enuphe1ment is slow and subJect to error 
In 
some cases enopherment can be accompl1shed only by smgle-letter operation 
For if the 
mterruptor lS a cipher letter the key is mterrupted by a letter which cannot be known ID advance, 
if the mterruptor is a plain-text letter, \\lule the mterruptions can be md1cated before enc1pher- 
ment is begun, the inegulanties occ8.Sloned by the mterrupt1ons m keymg c,ause confuSlon and 
quite matenally retard the enc1phenng process 
In deuphenng, the rate of speed would be 


JUSt as slow m e1ther method 
It is obvious that one of the pnnc1pal disadvantages mall these 
methods lS that if an error m transmisSlon is made, if some letters are onntted, or if anything 
happens to the mterruptor letter, the mese.age becomes difficult or unposs1ble to decryptograph 
by the ordmary code clerk 
Fmally, the degree of cryptographic secunty attamable by most 
of these methods JS not sufficient for rruhta.ry purposes 


SECTION VI 


REVIEW OF AUTO-KEY SYSTEMS 


Paragraph 


The two basic methods of auto-ke~ enc1pherment--------------------------------------------------- 
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23 The two basic methods of auto-key enc1pherment -a In auto-key encipherment there 


a.re two posSible sources for succesSive key letters the plam text or the cipher text of the message 
itself 
In either case, the initial key letter or key letters are supplied by preagreement between 
the correspondents, after that the text letters that are to serve as the key are displaced 1, 2, 3, 
mtervals to the nght, depen<lmg upon the length of the prearranged key 
b (1) An example of plam-text keymg wtll first be shown, to refresh the student's recollec- 


tion 
Let the previously agreed upon key consist of a smgle letter, say X, and let the cipher 


alphabets be direct standard alphabets 


Key _____________________ X N 0 T I F Y Q U A R T E R M A S T E R 
Plam ___________________ N 0 T I F Y Q U A R T E R M A S T E R 
Cipher__________________ K B H B N D 0 K U R K X V D M S L X V 


(2) Instead of haVlilg a smgle letter serve as the mitial key, a word or even a long phrase 
may be used 
Thus (usmg TYPEWRITER as the rmtial key) 


Key _____________________ T Y P E W R I T E RI N 0 T I F Y Q U A R 
Plam ___________________ N 0 T I F Y Q U A R T E R M A S T E R 
Cipher__________________ G M I M B P Y N E I G S K U F Q J Y R 


c (1) In cipher text auto keymg the procedure IS qwte suntlar If a smgle rmtial key letter 


IS used 


KeY--------------------- 
~I K Y R Z E C S M M D W A R D D V 0 S 
Plam ___________________ N 0 T I F Y Q U A R T E R M A S T E R 
Cipher__________________ K Y R Z E C S M M D W A R D D V 0 S J 


(2) If a key word is used 


Key_____________________ T Y P E W R I T E RI G M I M B P Y N E I 
Plam ___________________ N 0 T I F Y Q U A R T E R M A S T E R 
Cipher __________________ G M I M B P Y N E I Z Q Z Y B H R R V 


(3) Sometimes only the last cipher letter resultmg from the use of the prearranged key 
word IS used as the key letter for enciphenng the auto-keyed portion of the text 
Thus, m the 
last example, the plam text begmmng TERMASTER would be enciphered as follows 


Key _____________________ T Y P E W R I T E RI I B F W I I A T X 
Plam ___________________ N 0 T I F Y Q U A R T E R M A S T E R 
Cipher__________________ G M I M B P Y N E I B F W I I A T X 0 


(28) 


29 


d In the foregomg examples, direct standard alphabets are employed, but rmxed alphabets, 


either mterrelated or mdependent, may be used Just as readi.Jy 
Also, mstead of the ordmary 


type of cipher alphabets, one may employ a mathematical process of addition (see par 40} of 
Special Text No 166, .Advanced Military Cryptography) but the drlference between the latter 
process and the ordmary one uSlllg slidmg alphabets IS more apparent than real 
e Smee the analy81s of the case m which the cipher text constitutes the auto key IS usually 


eaSier than that m which the plam text serves this function, the former will be the first to be 
discussed 
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SECTION VII 


SOLUTION OF CIPHER-TEXT AUTO-KEY SYSTEMS 


Parqraph 
Solution of cipher-text auto-keyed cryptograms when known alphabets are employed_____________________________ 
24 
General pnnciples underlymg solution of cipher-text auto-keyed cryptograms by frequency analysis__________ 
25 
Frequency dll!tnbutions required for solution ------------------------------------------------------------------------------ 
26 


Example of solution by frequency analyslS-------------------------------------------------------------------------------- 
27 


Example of solution by analysis of isomorphisms __ ------------------------------------------------------------------------ 
28 


Special case of solution of cipher-text auto-keyed cryptogr1uns----------------------------- ---------------------------- 
29 


24 Solution of cipher-text auto-keyed cryptograms when known alphabets are employed - 
a (1) Fust of all it is to be noted that if the cryptanalyst knows the cipher alphabets which 
were employed m enc1pherment, the solution presents hardly any problem at all 
It is only 
necessary to decipher the message beyond the key letter or key-word portion and the 1Illt1al part 
of the plam text enuphered by this key letter or key word can be filled m from the context 
An example, using standard cipher alphabets, follows herewith 


CRYPTOGRAM 
WSGQV OHVMQ WEQUH AALNB NZZMP ESKD 


(2) Wntmg the cipher text as key letters (displaced one mterval to the right) and dec1phenng 
by direct standard alphabets yields the followmg 


Key______________ 
W S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M P E S K 


Cipher___________ W S G Q V 0 H V M Q W E Q U H A A L N B N Z Z M P E S K D 
Plam_____________ 
W 0 K F T T 0 R E G I M E N T A L C 0 M M A N D P 0 S T 


(3) Tuai of the word REPORT as the imt1al word of the message yields an mtelhgible word 


as the lilltlal key FORCE, so that the message reads 


Key_____________________ F 0 R C E V 0 H V M Q 
Cipher__________________ W S G Q V 0 H V M Q 
Plam____________________ R E P 0 R T T 0 R E • 


(4) A semiautomatic method of solvmg such a message is to use shdmg normal alphabets 
and align the stnps so that, as one progresses from left to nght, each cipher letter is set oppoSite 
the letter A on the precedmg stnp 
Takmg the letters VMQWEQUHA m the foregomg example, 
note in Figure 7 the senes of placements of the successive strips 
Then note how the succesSive 


plam-text letters of the word REGIMENT reappear to the left of the successive Cipher letters 
MQWEQUHA 


(80) 
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AVHXTXNHO 
BWIYUYOIP 
CXJZVZPJQ 
DYKAWAQKR 
EZLBXBRLS 
FAMCYCSMT 
GBNDZDTNU 
H C 0 E A E U 0 V 
IDPFBFVPW 
J E.....Q. G C G W Q X 
KFRHDHXRY 
LGSIEIYSZ 
MHTJFJZU 
NIUKGKAUB 
OJVLHLBVC 
PKWMIMCWD 
QLXNJNDXE 
RMYOKOEYF 
S N Z P L P F Z E 
TOAQM....QGAH 
UPBRNRHBI 
V Q C S O S I C J 
WRDTPTJDK 
XSEUQUKEL 
YTFVRVLFM 
ZUGWSWMGN 


FiGUBll: 7 


b If as a. result of the analySls of several messages (as descnbed m par 25), mixed 


pnmary ~omponents have been reconstructed, the solution of subsequent messages may reat1y 
be accomplished by followmg the procedure outlined m a above, smce m that case the eip er 
alphabets have become known alphabets 
b 


25 General principles underlying solution of cipher-text auto-keyed cryptograms 
1 
freque~cy analysis -a Frrst of all, it is to be noted In connection with cipher-text auto-keymg 
that repetitions will not be nearly as plentiful m the cipher text as they are m the plam t8ft, 
because m this system before a repetition can appear two thmgs must happen Simultaneous Y 
First of course the plam-text sequence must be repeated, and second, one or more cipher-text 
lette;s (depen~g upon the length of the mtroductory key) 1m.med1ately before the second appear 
ance of the pla.m-text repetition must be 1dent1cal with one or more cipher-text letters rmmediate 
1 
Y 


before the first appearance of the group 
This can happen only as the result of chance 
n 
the followmg example the mtroductory key 1s a smgle letter, X, and direct standard components 
a.re used m the usual V1genere manner 


KeY------------------ X C K B T M D H N V H L Y 
Plam_________________ F I R S T R E G I M E N T 
Cipher-----·--------- C K B T M D H N V H L Y R 


KDKSJMDHNVHLY 
THIRDREGIMENT 


KDKSJMDHNVHLYR 
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The repeated plam-text word, REGIMENT, has only 8 letters but the repeated cipher-text group 
contams 9, of which only the last 8 letters actually represent the plam-text repetit10n 
In 
order that the word REGIMENT be enciphered by D H N V H L Y R the second time this 
word appeared m the text it was necessary that the key letter for its first letter, R, be M both 
times, no other key letter will produce the same cipher sequence for the word REGIMENT m this 
case 
Each different key letter for enc1pbermg the first letter of REGIMENT will produce a 


different enc1pherment for the word, so that the chances 1 for a repetit10n m this case are roughly 
about 1 m 26 
This is the pnnc1pal cause for the reduct10n m repet1t10ns m this system 
If 
an mtroductory key of two letteis were used, it would be necessary that the two cipher letters 
immediately before the second appearance of the repeated word REGIMENT be identical with 
the two cipher letters immediately before the first appearance of the word 
In general, then, 
an n-letter repet1t10n m the cipher text, m this case, represents an (n-k)-letter repet1t10n m the 
plam text, where n is the length of the cipher-text repet1t10n and k is the length of the mtroductory 
key 


b There 1s a second phenomenon of mterest m connect10n with the cipher-text auto-key 
method 
Let the letter opposite wluch the key letter is placed (when usmg slidmg components 
for enc1pherment) be termed, for convemence m reference, "the base letter " 
Normally the 
base letter 1s the lllltial letter of the plam component, but it has been seen rn precedmg texts 
that tlus is only a convent10n 
Now when the mtroductory key is a smgle letter, if the base 
letter occurs as a plam-text letter its cipher eqmvalent is identical with the immediately pre- 
cedmg cipher letter, that is, there is produced a double letter m the cipher text, no matter what 
the cipher component is and no matter what the key letter happens to be for that enc1pherment 
For example, usmg the H Y D R A U L I C 
X Z sequence for both pnmary com- 
ponents, with H, the m1t1al letter of the plam component as the base letter, and usmg the 
mtroductory key letter X, the followmg enc1pherment is produced 


Key________________________ X J 0 I I F L Y U T T D K K Y C X G 
Pl am---------------------- M A N H A T T A N H I G H J I N K S 
C1 pher -------------------- J 0 I I F L Y U T T D K K Y C X G L 


Note the doublets II, TT, KK 
Each time such a doublet occurs it means that the second letter 
represents Hp, which is the base letter m tlns case (m1tial letter of plam component) 
Now if 


the base letter happens to be a lngh-frequency letter m normal plam text, for example the letter 
E, or T, then the cipher text will show a large number of doublets, if it happens to be a low-fre- 
quency letter the cipher text will show very few doublets 
In fact, the number of doublets 


will be drrectly proportional to the frequency of the base letter m normal plam text 
Thus, 


if the cryptogram contams 1,000 letters there should be about 72 occurrences of doublets if 
the base letter is A, smce m 1,000 letters of plam te:i..t there should be about 72 A's 
Conversely, 


if a cryptogram of 1,000 letters shows about 72 doublets, the base letter is likely to be A, if it 
shows about 90, it is likely to be T, and so on 
Furthermore when a clue to the identity of the 
base letter has been ob tamed m this manner, it is possible immediately to msert the correspondmg 
plam-text letter throughout the text of the message 
The d1stnbut10n of tlus letter may not 
only serve as a check (if no mcons1stencies develop) but also may lead to the assumption of 
values for other cipher letters 
c When the mtroductmy key is 2 letters, then this same phenomenon wtll produce groups 
of the formula ABA, where A and B may be any letters, but the first and third must be identical 
The occurrence of patterns of this type m tlns case md1cates the enc1pherment of the base letter 


l If all the cipher letters appeared with equal frequency the chances would be exactly 1 m 26 
But certam 
letters appear with greater frequency because some plam-text letters are much more frequent than others 
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d The phenomena noted above can be used to considerable advantage in the solut10n of 
cryptograms of this type 
For mstance, if it is known that the ordmary V1genere method of 
encipherment 18 used (ek12=81/l, eil11=8c12), then the imt1al letter of the plam component is 
the base letter 
If, further, 1t 1s kno\\>n that the plam component rn the normal drrect sequence, 
then the base letter is A and a word such as BATTALION will be enciphered by a group havmg 
the formula AABCCDEFG 
If the plam component is a mixed sequence and happens to start 


with the Jett;;-E~hen a word such as ENEMY would be enciphered by a sequence havmg the 
formula AABBCD 2 Sequences such as these are, of course, id10morplnc and if words yieldmg 
such id10morphisms are frequent m the text there will be produced m the latter several or many 
cases of isomorplusm 
When these are analyzed by the prmciples of mdrrect symmetry of 
pos1t10n, a qmck solut10n may follow 
e A final prmciple underlymg the solut10n of cipher-text auto-keyed cryptograms remams 
to be discussed 
It concerns the nature of the frequency d1stnbut10ns requrred for the analysis 
of such cryptograms 
Tlns prmciple will be set forth m the next paragraph 
26 Frequency distributions required for solution -a Consider the message given m 
paragraph 23c (1) 
It happens that the letter Re occurs twice m this short message and, because 
of the nature of the cipher-text auto-keymg method, this letter must also appear twice m the 
key 
Now it is obvious that all plam-text letters enciphered by key letter R:t will be m the same 
cipher alphabet m other words if the key text is "offset" one letter to the nght of the cipher 
text then every 


1cipher letter whi~h immediately follows an Ro in the cryptogram wdl belong t\the 


sam~ cipher alphabet and this alphabet may be designated convemently as the R cipher alpha et 
Now if there were ~uffic1ent text, so that there were, say, 30 to 40 Re's m it, then a frequency 
d1stnbut10n of the letters immediately followmg the R.'s will exhibit monoalphabeticity 
What has been said of the letters followmg the Re's applies equally well to the letters follovmig 


h 
tl A ' B ' C ' 
nd so on 
In short if 26 d1str1but10ns 
all the other letters of the cip er text, · ie cs, cs, • s, a 
' 
d 
are made one for each letter of the alphabet, showmg the cipher letter nnmediately succee mg 
each diff~rent letter of the cipher text, then the text of the cryptogram can be allocated mto 26 
umhteral, monoalphabetic frequency d1stnbut10ns which can be solved by frequency analysis, 
prov1dmg there are sufficient data for this purpose 
b The foregomg pnnc1ple has been descnbed as pertammg to the case when the mtroductory 
key is a smgle letter, that is, when the key text is "offset" or displaced but one mterval to the 
nght of the cipher text 
But it apphes equally to cases wherem the key text is offset more than 
one mterval provided the frequency d1str1but10ns are based upon the proper mterval, as deter- 
mmed by the displacement due to the length of the mtroductory key 
For mstance, suppose 
the mtroductory key consists of two letters, as m the followmg example 
Key text __________________ X Zj M R H F H G F N Q R X 0 M R M 6 : E E 
Plam text ---------------· R E L I A B L E I N F 0 R M A T I 
E 
• 
Cipher text ______________ M R H F H G F N Q R X 0 M R M V W E 


The key text m this case is offset two mtervals to the right of the cipher text and, therefore, ~e­ 
quency distr1but1ons made by takmg the cipher letters one mterval to the nght of a given ct e~ 
letter each time that letter occurs, wtll not be monoalphabet1c because some letter not re ate 
at all to the given cipher letter 18 the key letter for enc1phermg the letter one mterv~hto fithe 
rwht of the latter 
For example, note the three Re's m the foregomg illustration 
e rst 


Rb is followed by H representmg the encipherment of Lil by Mk, the second R. is followed hby x., 
0 
0 
' 
hi d R 
f 11 
d b M representmg t e en- 
representmg the enc1pherment of Fil by Qk, the t r 
•is 0 owe 
Y "' 1 
1 t d 
d d 
cipherment of All by Mk 
The three cipher letters H, X, and Mare here entrre Y unre a e an ° 


2 Six letters are shown because the 1d10morphism m this case !lxtends over that many letters 
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not belong to the same cipher alphabet because they represent enc1pherments by three different 
key letters 
On the other hand, the cipher letters two mtervals to the right of the R0's, viz, 


F, 0, and V, are m the same cipher alphabet because these cipher letters are the results of en- 
c1phenng plam-text letters I, 0, and T, respectively, by the same key letter, R It is obvious, 
then, that when the introductory key consists of two letters and the key text is displaced two 
mtervals to the right of the cipher text, the proper frequency distributions for monoalphabet1c1ty 
will be based upon the letter at the second mterval to the right of each cipher letter 
Likewise, 
rl the mtroductory key consists of three letters and the key text is displaced three mtervals to 
the nght of the cipher text, the d1str1but10ns must be based upon the third mterval, and so on, 
m each case the mterval used correspondmg to the amount of displacement between key text 
and cipher text 
c Conversely, in solvmg a problem of this type, when the length of the mtroductory key 
and therefore the amount of di<>placement are not known, the appearance of the frequency dis- 
tributions based upon vanous mtervals after each different cipher letter will disclose this un- 
known factor, smce only one set of d1stnbut10ns wtll exhibit monoalphabet1c1ty and the mterval 
correspondmg to that set wtll be the correct mterval 
d Apphcation of these principles wtll now be made, usmg a specific example 
27. Example of solution by frequency analysis -a It will be assumed that previous studies 
have disclosed that the enemy is using the cipher-text auto-key system descnbed 
It wtl1 be 
further assumed that these stud10s have also disclosed that (1) the mtroductory key is usually a 
smgle letter, (2) the usual V1genere method of employmg shdmg pnmary components 1s used, 
(3) the plam component is usually the normal direct sequence, the cipher component a mIXed 
sequence which changes datly. The followmg cryptograms, all of the same date, have been 
mtercepted 


I J X W X 
Q ZS X D 
EH H L M 
CARP H 
TD IQ K 
0 KN TB 


GR V RM 
RT NJ U 
F H I J A 
F F N F I 
A 0 0 X D 


R W K A 0 
M W T Q 0 
LA Q YU 


EEC DA 
HI FE L 
R V C U R 
MG L DY 
KM LT U 
T Z J 0 Q 


Z WK X G 
A K 0 B L 
Q B M L T 
B W N Y S 
BUY N K 


LT CJ M 
HQ VG X 
K I R 0 Z 


MESSAGE I 


C N Q E T 
N NJ JI 
G D I E Q 
FY TC D 
R Q G G N 
Y SC DI 


MESSAGE II 


W P C K K 
NL MW K 
PURRS 
T C E T P 
L B W C D 


MESSAGE III 


Z D K V U 
CH 0 L M 
T Q YU X 


UK NM V 
DIVE Y 
SGT AR 
G Y F KR 
KM KI X 
D GET X 


RM X AN 
y y z Ju 
U E Q E V 
D G T T Z 
G GK XX 


J C D D Y 
WV GR K 


D I W P P 
GT CZ M 
J J Q Q y 
F K S E T 
J X WK A 
GXXXX 


Jc c x u 
CSU HF 
Z E Y G C 
RR Q HQ 


B Z ELM 
I B R X D 


X J JP M 
TUT CV 
SUM U J 


G I S U H 
X CT BS 
HAGIE 
P S F A J 
WP VI B 
MUZEL 
F 0 R S A 


T B J P A 
B DA Q Y 
CE CZ M 


TB JP A 
S F T Q T 
XUKTX 
FXXXX 


LT Z K X 
GR JP F 
C S L G X 


W Z HST 
F KI RH 
WMEHH 
U Q Z H Z 
0 BC C X 
y 0 0 v u 
J L N QM 


ARY Y P 
MM TT F 
MW 0 H C 


QA AZT 
C J J G J 
G G B 0 X 
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MESSAGE IV 


EC A Q Z 
F D I P P 
H X M 0 Z 


MESSAGE v 


T Z 0 I D 
MMVYM 
L MW KY 
MT F HZ 
N N D G I 
J W K I E 
B Q XX X 


MESSAGE VI 


V H I D I 
U UN MG 
F 0 B H V 


MESSAGE VII 


RX AL X 
0 V MR G 
M X DID 


N T T 0 C 
D I X C E 
E K A Q I 


D H 0 0 V 
I I V U U 
P P D Q Z 
M L A C Z 
E S J 0 C 
I B B 0 Z 


TUX NJ 
Q PU X M 
N K A Z C 


F K KM E 
L V W T T 
S P B S F 


0 N D U C 
S E T W W 
S U A 0 X 


NB T JG 
C Z M J E 
G B 0 I W 
R 0 V D I 
K B J H Q 
A J I E F 


M X GS S 
0 V U Y E 
KMXXX 


I A A B D 
J U A W L 
L Y Z K C 


b A dist:i;i.bution table of the type described m paragraph 25e is compiled and lS shown as 
F 
8 below 
Jn makmg these distnbut10ns it 1s simple to msert a tally m the appropriate 
c:IT~ the pertment honzontal hne of the table, to mdlcate the cipher letter wlu~h nnmet~a~l~ 
follows each occurrence of the letter to which that lme applies 
Obv10usly, the est me o o 


m tlmg the data 18 to handle the text d1graphically, talang the first and second letters, the 


~~co~d and tlurd, the third and fourth, and so on, and d1stnbutmg the final letters of the digraphs 
ma quadncular table 
The distnbution merely takes the form of tally marks, the fifth bemg a 
diagonal stroke so as to totahze the occurrences visibly 


A 
B 
c 
D 
E 
F 
G 
H 
I 
J 


P:lK 
~ L 
tl M 


to-"< N 


~ 0 
P:l 
i:;;: p 
Q 
R s 
T 
u 
v 
w 
x 
y 
z 
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SECOND LETTER 
ABCDEFGH I 
JKLMNO PQRSTUVWXYZ 


Ill I 
II 
I 
Ill I 
I 
I 
Ill/ 
iflll Ill 
I 
II 
- 
- 
- 
- 
- 
- 
- 
- --- 
- 
- 
- - - 
- 
- 
- 
- - - - - - - 
- 
I 
I 
Ill 
I 
II/ 
I 
I 
Ill/ 
I 
I 
II 
Ill I 
II 
I 
- 
- 
- 
- 
- - - - -- - 
- - 
- 
- 
- - - 
- 
- - - - 
- 
- - 
II 
II 
iHI Ill Ill 
I 
II 
Ill 
I 
II 
I 
I 
I 
Ill 
Ill/ 
- 
- - 
- 
- 
- - 
- --- 
- 
- - 
- 
- - - 
- 
- 
- 
- 
- 
- 
- 
II 
I 
II 
I 
iHI II 
ifllifll 
I 
I 
- 
- 
I 
II 
II 
- 
- 
- - - 
- 
- 
- -- - 
- - - - 
- 
- 
- 
- 
- 
- 
- 
- - - - - 
/Ill 
I 
I 
Ill II 
I 
Ill 
II 
II 
iHI 
I 
I 
II 
- - - - 
- 
- - - 
- 
-- 
-- - 
- 
- - 
- 
- - - - 
- 
- 
- 
- - 
- 
I 
I 
I 
Ill/ 
II 
I 
I 
Ill/ I 
I 
II 
I 
I 
I 
- 
- 
- 
- 
- 
- 
- -- - 
- 
-- - 
- 
- 
- 
-- - 
- 
- 
- 
- 
II 
I 
I 
I 
Ill 
Ill 
I 
I 
II 
I 
- 
- 
- 
- 
I 
Ill I 
Ill 
I 
II 
I 
- 
- 
- 
- - - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
I 
I 
I 
II 
Ill 
II 
I 
II 
- 
Ill 
I 
I 
I 
I 
II 
- 
- 
- 
- 
- - - 
- --- 
- - - - - 
- 
- 
- - 
- 
- - - 
I 
Ill/ 
iHI iHI I 
I 
II 
- 
- 
I 
I 
II 
II 
I 
II 
Ill II 
- 
- 
- 
- 
- 
-- - - -- - 
- - - 
- 
- 
- 
- - 
- 
- 
- 
- 
- - 
- 
I 
/Ill 
I 
I 
I 
II 
Ill/ 
I 
/fl 
Ill /Ill I 
Ill 
I 
II 
- 
- 
- 
- - - 
- 
- -- - 
- 
- 
- 
- 
- 
- 
- 
- 
- - 
- 
- 
/Ill I 
I 
- 
- 
- 
- 
iHI 
Ill I 
/Ill II 
I 
II 
I 
I 
I 
fl 
II 
- - 
- 
- - - 
- 
- -- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- - 
II 
I 
I 
I 
- 
- - 
- 
iHI /ff 
II// 
I 
fl 
II 
- 
- 
- 
- 
- - 
- 
- --- - - - 
- 
- - 
- 
- 
- 
- 
- 
- 
Ill 
Ill 
Ill 
I 
I 
I 
- 
- 
- 
- 
1111 Ill/ 
II 
II 
II 
II 
II 
iflll Ill 
II 
- 
- 
- 
- 
- 
- 
- 
- -- - - 
- 
- 
- 
- 
- 
- 
- 
- 
I 
I 
I 
/Ill Ill I 
II 
II 
- 
- 
- 
- 
II 
I 
I 
- - 
- 
- 
- 
- 
- 
- --- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- - 
Ill I 
II 
II 
I 
- 
- 
- 
- 
If 
Ill 
I 
I 
iHI 
II 
Ill 
- 
- 
- 
- 
- 
- - - --- 
- 
- 
- 
- 
- 
II 
I 
I 
Ill 
I 
I 
- 
- - - 
- 
- 
- 
- 
- 
- 
- 
I 
Ill I 
I 
II 
fl 
- 
- - 
- 
- - - - --- - 
- 
- 
- 
- 
- -- - 
- 
- 
- 
- 
II 
I 
II 
I 
I 
I 
I 
- 
- 
- 
- 
II 
I 
I 
I 
I 
I 
I 
iHI /Ill 
- 
- 
- 
- 
- 
- - 
- --- 
- 
- 
- 
- - 
- 
- 
- 
- 
- - 
- 
- 
- 
- 
I 
II 
I 
II 
I 
II 
II 
I 
II 
fl 
fl 
I 
If 
I 
II 
I 
- - 
- 
- 
- 
- 
- 
- -- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
I 
I 
I 
fl 
Ill/ I 
-- - 
--- 
I 
I 
I 
I 
II 
iHI 
I 
- - 
- 
- 
- 
- 
- - ---- - 
- - 
- 
- 
- 
- - 
- 
I 
Ill/ ifl!I I 
II 
- 
- 
- 
- 
fl 
I 
If 
Ill I 
iHI /Ill 
I 
II 
/Ill 
- 
- 
- 
- 
- 
- 
- 
- -- 
- 
- 
- 
- - -- 
- 
- - 
Ill 
Ill 
I 
II 
Ill Ill 
- 
- 
- 
- 
- 
I 
I 
I 
!Ill 
I 
II 
II 
II 
I 
- 
- --- 
- 
- 
- 
- --- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
I 
- 
- 
- 
- 
II 
I 
Ill I 
I 
I 
II 
I 
/Ill 
I 
I 
I 
- 
- 
- 
- 
- 
- 
- 
- -- - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- - 
- 
- - 
I 
iflll I 
I 
I 
I 
Ill/ 
I 
II 
I 
I 
II 
I 
- - 
- 
- 
- 
- - 
- -- - 
- 
- 
- 
- 
- 
- 
- 
- 
- - 
- 
- 
- 
- 
- 
- 
II 
Ill Ill/ II 
I 
Ill/ I 
II 
/Ill II 
II 
II 
- 
- 
- 
- - --- 
- -- - - 
- 
- 
- 
- 
- 
- 
- 
- 
- 
I 
I 
- - - - 
- 
- 
I 
II 
If 
If 
I 
I 
II 
II 
I 
II 
'rf; 
II 
- 
- 
- 
- 
- 
- 
- 
- --- - - 
- 
- 
- 
I 
I 
I 
Ill/ 
- 
- 
- 
- 
- 
- 
- 
- 
- 
- 
I 
II 
II 
II 
ifll/ 
I 
II 
I 
II 
I 


FIGURE 8 
c The md1v1dual frequency d1stnbut10ns give every appearance of bemg monoalphabet1c 


which checks the assumpt10n that the enemy is still employmg the same system 
The totai 
number of letters of text (excludmg the final X's) is 680 
If the base letter is A then there should 
be approximately 680X7 23=49 cases of double letters m the text 
There are actually 52 
such cases, which checks qUite well with expectancy 
The letter A is substituted throughout 
the text for the second letter of each doublet 
d The followmg sequence is noted 


Message V, lme !__ _______ G I S U H 
W Z H S T 
T Z 0 I D D H O O V N B T J G 
A 
A 
A 
Assume that the sequence DDHOOVNBT represents BATTALION 
Then the frequency of Hem the 
D cipher alphabet should be high, smce H0 =T1> 
The H has only 2 occurrences 
L1kew1se the 
frequency of o. m the H alphabet (=TI>) should be l11gh, it ir, nlso only 2 
The frcquenc/ of V 
m the 0 alphabet should be medrnm or low, smce it would equ.il L1,, it is 5, wlnch is too high 
The rest of the letters of the assumed word are sumlarly checked agamst the appropriate fre- 
quency d1stnbut10ns1 with the result that, on the whole, the assumpi10n that the DDHOOVNBT 
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sequence represents BATTALION does not appear to be warranted 
S1m1lar attempts are made 
at other pomts m the text, with the same or other probable words 
Some of these attempts 
may have to be carried to the pomt where the placement of' alucs m the tentative cipher com- 
ponent leads to ser10us mcons1stenc10s 
Fmally, attent1011 is fixed upon the follo\Hng sequence 


Message VI, hne 2 _________ B D A Q Y M M T T F 
A 
A 


U U N M G 
A 


MMTTFUUNMG 
The word AVAILABLE is assumed 
The nppropnate frequency distnbut10ns are consulted 
to see how well the actual md1v1dual frequencrns corrPspond to the expected ones 


Assumed 
Frequency 
Alpha 
Approx1 
bet 
rnat1on 
e, 
e. 
hxpected 
Artual 


M 
T 
v 
Low 
2 
Fair 


T 
F 
I 
High 
2 
Fair 


F 
u 
L 
Mt0dmm 
1 
Good 
u 
N 
B 
Low 
1 
Good 
N 
M 
L 
Med mm 
2 
Fair 


M 
G 
E 
.High 
3 
Fair 


The assumpt10n cannot be discarded JUst yet 
Let the values denvable from the assumpt10n 


be mserted m their proper places m a cipher component, and, usmg the latter m conJunct10n 
with a normal direct sequence as the plam component, let an attempt be made to find corrobora- 
t10n for these values 
The followmg placements may be made 


Plam_________________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher _______________ M 
F G 
U N 
T 


The letter M0 appears twice m the cipher sequence and when tlns partially reconstructed cipher 
component is tested it is found that the value L1>(Nt)=M0 is corroborated 
HaVIng the letters 
M, F, G, U, N, and T tentatively placed m the cipher component, it is possible to msert certam 
plam-text values m the text 
For example, m the M alphabet, F 0 ==D1>, G0=Ep, U0 =01>, N0 =Pp, 
T0 =V1> 
In the F alphabet, G0 =B1>, U0 =L1>, N0 =M1>, T0 =S1>, M0 =X1> 
The other letters yield 
add1t1onal values m the appropriate alphabets 
The plam-text values thus obtamable are 
mserted m the cipher text 
No mconsrntencies appear and, moreover, certam "good" digraphs 
are brought to hght 
For mstance, note what happens here 


Key____________ 
U Q Z H 
Message V, lme 4 __________________ Cipher _________ U Q Z H Z 
Plam __________ _ 


Z MT F H 
M T F H Z 


V I 


Z M L A C 
M L A C Z z 


Now if the letter H can be placed m the cipher component, several values might be added to this 
partial decipherment 
Notmg that F and G are sequent m the cipher component, suppose H 
follows G therem 
Then the followmg is obtamed 


Key____________ 
U Q Z H 
Message V, lme 4 ----------------- Cipher _________ U Q Z H Z 
Plam __________ _ 


Z MT F H 
MT F HZ 


V I C 


Z M L A C 
M L A C Z z 
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Suppose the VIC JS the begmmng of VICINITY 
Tlus assumption perm.its the placement of 
A, C, L, and Z m the cipher component, as follows 


Plam_________________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher _______________ M A 
F G H 
L 
Z U N 
T 
C 


These additional values check m very mcely and presently the entire cipher component JS 
reconstructed 
It is found to be as follows 


Plam_________________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher _______________ M A B F G H J K L Q S V X Z U N D E R W 0 T Y P I C 


The key phrase JS obV1ously UNDERWOOD TYPEWRITER COMPANY 
All the messages now may 
be deciphered with ease 
The followmg gives the letter-for-letter decipherment of the first 
three groups of each message 
I (Introductory key K) 


Key_______________________ Kl I J X W 
Cipher ____________________ T J X W X 


Plam---------------------- R I G H T 


XE EC D 
EEC DA 
FAIR L 


II (Introductory key E) 


Key _______________________ Ej G R V R 
Cipher ____________________ G R V R M 
Plam______________________ N 0 T H I 


MZWKX 
ZWKXG 
NG 0 F S 


III (Introductory key R) 


KeY----------------------- Bl R W K A 
Cipher____________________ R W K A 0 
Plam______________________ A B 0 U T 


0 LT CJ 
LT CJ M 
0 NE HU 


IV (Introductory kev J) 


KeY----------------------- ~ X J J P 
Cipher ____________________ X J J P M 


Plam______________________ G U A R D 


ML T Z K 
LTZKX 
I N S U F 


V (Introductory key E) 


Key _______________________ ~ G I S U 
Cipher ____________________ G I S U H 


Plam---------------------- N U M E R 


HWZHS 
W Z HST 
0 U S F L 


VI (Introductory key 8) 


KeY----------------------- ru T B J P 
Cipher____________________ T B J P A 
Plam______________________ T H E R E 


AARYY 
ARY Y P 
ARE AB 


VII (Introductory key 8) 


KeY----------------------- m 
T B J P 
Cipher ____________________ T B J P A 


Plam______________________ T H E R E 


AQAAZ 
QAAZT 
I S A M I 


AC NC Q 
C N Q ET 
Y Q U I E 


G WP CK 
WP CK K 
P E C I A 


MZDKV 
Z DK VU 
ND RED 


XE CA Q 
EC A Q Z 
F I C I E 


T T Z 0 I 
T Z 0 I D 
ASHES 


P V HID 
V H I D I 
0 U T S I 


TRXAL 
RXALX 
XUPHE 
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e In the foregomg example the plam component was the normal direct sequence, so that 


with the Vigen~re method of enc1pherment the base letter is A If the plem component JS a 
mixed sequence, the base letter may no longer be A, but m accordance with the pnnciple set 
forth m paragraph 25b, the frequency of doublets m the cipher text will correspond with the 
frequency of the base letter as a letter of normal plam text If a good clue as to the identity 
of tlus letter JS afforded by the frequency of doublets m the cipher text, the msertion of the 
correspondmg base letter m the plam text will lead to further clues 
The solution from there 
on can be handled along the Imes mdicated above 


27 Example of solution by analysis of isomorphisms -a It was stated m paragraph 25d 
that m cipher-text auto-keying the production of ISomorphs is a frequent phenomenon and 
that analySis of these ISomorphs may yield a qmck solution 
An example of thJS sort will now 
be studied 


b Suppose the following cryptograms have been mtercepted 


us y p w 
BEK VB 
PM YU C 
TC V NI 
E FA AG 
AT N NB 
NXQWH 
TNKKU 


B I I B F 
X RSC T 
KT TC F 
JOEYM 


HAL 0 Z 
KZEKU 
XAGXD 
BJNNB 


TR X DI 
MAMMO 
NEV VJ 
X DD Q Q 
ZR L FD 
0 U P I T 
UV EVY 
XLODL 


GRXLG 
KVBWK 
KVKRO 
RPEEW 


JRRVM 
RFRFX 
MCUNX 
IT ML J 


MLEXR 
TX X B W 
L K Z EK 
EKKLR 
N D S C D 
J L X T C 
PL Q G W 
WT H CZ 


H 0 U Z O 
0 T GU Q 
B 0 E PL 
H 0 T JO 


MHCVB 
YBHAL 
XLXGZ 
0 0 SE A 


1 


KVDBD 
ENAXM 
U R C N I 
V RF RF 
MP BB V 
VA 0 VE 
UPVKU 
R 


2 


LLZNA 
Q F J 0 C 
QI G N R 
CR I IX 


3 


YUHAO 
ZOFHM 
JP WU I 
ATKPB 


D Q GS U 
Q L Z IX 
F Q F N N 
X R 0 CS 
DEW RR 
Y J J L K 
BMMLB 


MHCTY 
YYBVK 
IQ 0 VJ 
0 Z ET Z 


E 0 V A C 
RS J Y L 
FD BB Y 
y 


NSF B 0 
DIX G Z 
Y GS I J 
SJ TB V 
N QI CH 
DMLEG 
0 A E 0 T 


SC A AT 
IXDMT 
YKIPH 
NK 


QVVJL 
AP GR S 
P VF ZN 


c Frequency distributions are made, based upon the 2d letters of p8.1rB, as m the preceding 


example 
The result IS shown m the table m figure 9 
The data m each distribution are rela- 
tively scanty and it would appear that the solution lS gomg to be a rather chfficult matter 
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SECOND LETTER 
A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


A~--' __ 
1 -~----~~-~-'---~----'_,_A 
B 
II 
I 
I 
I 
I 
II 
I 
II 
Ill/ 
Ill II 
Ill 
B 
c11--,--,--,------n--,-,-,-n,-m--,-,-c 
D-N-Nl ____ n ___ 
t Wl---ff--1 -------D 
~------------------------- 
E It 
I 
I 
I 
1111 
I 
II 
I 
I 
II 
II 
I 
II 
E 
F,,-,--n--1,--,--, --,---,-n-----n-IF 
>--------------------- 
- 
G ________ 
t ----II 
1111 
I -,-,--111 G 


H~ 
Ill 
I 
,--n _____ u ______ H 


I --,---lj,-,-,-----,---,-,---,,---lii/-- I 
J---------,--M-/-Ml--/--l~----H 


1-J 
~K===t ===-n-#1---,-,--,-,-MM ___ ,ffK 
~Li I 
II I I --,,11-, --m-nt-----,-,,-mL 
~M~--,-----n---Mm-,-,-,-n-~----,-M 
~N~m-,-,----,,-n--m--,-,,-----n-, -N 
~o~nm,-m,------,--,---,-Mnm ___ no 
~P-n---, -,-,-,---n-1 --------nn ___ p 
Q====/ 111/=ll==f ==I =ll==--1-1----Q 
R 
I 
Ill/ 
II 
I 
I 
I 
II 
I 
II 
Ill __ ff_ff __ R 


s~-m-,-,---,-n--------,--,---,-,-·-s 
T-,-~---,-,--nm-,-"---,--1~---n,-'1T 
u-,-,-----,-,-----n-nln1---,--,--~u 


V11111=11~1 ~=~~w=t /==~t ===~---, -V 
W 
I 
I 
II 
I 
I 
II 
II ----- W 
x,-,--liiJ--n----1111--1--1-m-1 ____ #1--X 
Y-n-----, --,--, -, -, --m--,--n---,--y 
z----m---,-n---m~,--n--------z 


A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


Fmumi:9 


d However, before beconung discouraged too qmckly, a search is made throughout the 
text to see if any isomorphs are present 
Fortunately there appear to be several of them 
Note the followmg 


Message L---------lg~ 


(3) 
Message 2 ___________ (4) 
Message 3 ___________ (5) 


DBDDQG§UN§FBOBEK 
NEVVJLKZEKURCNIF 
T N K K U X .b 0 D .b W T H C Z R I end of message 


C R I I X 0 ~ E T ~ N K I end of message 
CQVVJLKZEKURFRFX 


Fin.t, it is necessary to dehm1t the length of the isomorph.., 
Isomorph (2) shows that the 1..,0- 


morplnsm bPgmc:; with the doubled letter<; 
For tlwrc I'3 an E hefor(' thP V V m that case and also 


.in E withm the 1c:;omo1 ph, if the phenomenon mrlud('d the E, thPn the letter immediately before 
the DD m the case of isomorph (1) would have to be an N, to match its homolog, E, in isomorph 
(2), which it is not 
Corroboratmg data are given by 1somorphs (3), (4), and (5) m this respect 
Hence, we may take it as estabhshed that the isomorphism begms with the doubled letters 
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As for the end of the isomorphism, the fact that 1somorphs (2) and (5) are the same for 10 letters 
seems to IDdlcate that that is the length of the isomorphism 
The fact that message 2 ends 2 
letters after the last "tie-m" letter, Z, corrobo1ates this assumption 
It is at least certam that 
the isomorphism does not extend beyond 11 letters because the recurrence of RID isomorph (5) 
is not matched by the recurrence of RID isomorph (2), nor by the recurrence of T ID isomorph (3) 
Hence it may be assumed that the isomorphic sequence is probably 10 letters ID length, possibly 
11 
But to be on safe ground it is best to proceed on the 10-letter basis 
e Applymg the prIDClples of IDdlrect symmetry to the supenmposed 1somorphs, partial 
chams of eqmvalents may be constructed and it happens m this case that practically the entire 
primary component may be established 
Let the student confirm the fact that the followIDg 
sequence may be denved from the data given 


1 
2 a 4 a e 1 s u m u u ~ H u ~ u ~ w ~ n n ~ ~ ~ ~ 
TEZKR. IVF. 
Q 
WG. NUSBXJDOL 


The only missIDg letters are A, C, H, M, P, and Y By use of the nearly complete sequence on the 
text it will be posSible to place these 6 letters m their poSit1ons m the Cipher component 
Or, If a 


keyword-lnlXed sequence is suspected, then the sequence which was reconstructed may be merely 
a decimation of the ongmal pnmary sequence 
By testing the partial sequence for vanous 


IDtervals, when the seventh is selected the followmg result IS obtamed 


1 
2 s • 1 e 7 a u m u u u H u ~ u u w m n n m • z m 
TVWXZ •• DR 
ULI 
BEFGJK 
NO 
QS 


The sequence is obviously based on the keyword HYDRAULIC, and the complete primary Cipher 
component IS now available 
The plaID component is then to be reconstructed 
A word must 
be assumed ID the text 
f A good probable word to assume for the IO-letter repetition found m messages 1 and 3 


IS ARTILLERY 
This smgle assumption IS sufficient to place 7 letters ID the plam component 
Thus 


KeY---------------- 
V V J L K Z E K U R 
Plam_______________ 
A R T I L L E R Y 
Cipher------------- • • V V J L K Z E K U R 


1 
2 
s 
4 
a 
11 
1 
s 
g 10 11 
12 18 li 15 10 17 1s 19 ~ n 
n 
m ~ ~ • 


A 
E 
I 
L . 
R.T 
y 


These few letters are sufficient to IDdlcate that the plam component is probably the normal 
direct sequence 
A few mmutes testmg proves this to be true 
The two components are there- 
fore 
Plam______________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher ____________ H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z 


With these two components at hand, the decipherment of the messages now becomes a relatively 
Simple matter 
Assummg a sIDgle-letter mtroductory key, and trymg the first five group!i of 
message 1 the results are as follows 


KeY---------------- ? U S Y P 
W T R X D 
I M L E X 
R K V D B 
D D Q G S 
Cipher _____________ U S Y P W T R S D I 
M L E X R K V D B D D Q G S U 
Plmn--------------- ? P H R F 
Y I V E F 
I R E 0 F 
L I G H T A R T I L 
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It 1B obvious that an mtroductory key of more than one letter was used, smce the first few letters 
yield unmtelhgible text, but it also appears that the last cipher letter of the mtroductory key 
was used as the mtroductory key letter for enciphermg the subsequent auto-keyed portion of 
the text (see par 23c{3)} 
However, assummg that the IVE before the word FIRE IS the endmg 
of the first word of the plam text, and that this word is INTENSIVE, the mtroductory key word 
is found to be WICKER 
Thus 


Key ------ ---- W I C K E RI T R X D I M L E X R K V D B D D Q G S • 
Pla.m__________ I N T E N S I V E F I R E 0 F L I G H T A R T I L • 
Cipher________ U S Y P W T R X D I M L E X R K V D B D D Q G S U • 


The begmnmgs of the other two messages a.re recoverable m the same way and are found to be 
as follows 


Key _________________ P R 0 M I S El R X L G H 0 U Z 0 
Ple.m_________________ R E Q U E S T V I G 0 R 0 U S 
Cipher______________ B I I B F G R X L G H 0 U Z 0 


Key__________________ C H A R G E DI R R V M M H C V B 
Plam_________________ S E C 0 N D B A T T A L I 0 N • 
Cipher ______________ H A L 0 Z J R R V M M H C V B 


g The example solved m the foregomg subparagraphs offers an important lesson to the 
student, msofar as it teaches lum that he should not immediately feel discouraged when confronted 
with a problem presenting only a small quantity of text and therefore affording what seems at first 
glance to be an insujficient quantity of data for solution 
For m tlus example, while it 18 true that 
there are msufficient data for analysis by simple prmCiples of frequency, it turned out that 
solution was aclueved without any recourse to the principles of freg:uency of occurrence 
Here, 
then, 18 one of those mterestmg cases of substitution ciphers of rather complex construction 
wluch are solvable without any study whatsoever of frequency distnbutions 
Indeed, it wtll 


be found to be true that m more than a few mstances the solution of qmte complicated cipher 
systems may be accomplished not by the application of the prmciples of frequency, but by 
recourse to mductive and dednrtive reasomng based upon other wnsiderations, even though 
the latter may often appear to be vPry tenuoi.ls and to rest upon qwte fhmsy supports 


29 Specl8.l case of solution of cipher-text auto-keyed cryptograms -a Two messages with 
identical plam texts enciphered accordmg to the method of paragraph 23 c (3) by m1tl.al key 
words of different lengths and compositions can be ~olved very rapidly by reconstructmg the 
pnmary components 
The cryptographic texts of such messages will be isomorphic after the initial 


key-word portions 
Note the two followmg superunposed me.,sages, m wluch isomorphism be- 


tween the two cryptograms is obvious after their 6th letters 


I 
I 
I I 
....-.... 
I 


1 TS BJ S 
KB NL 0 
CF HA Z 
LWJAM 
BNFNS 
MVJRE 


2 BKKMJ 
X Y C X B 
HR P V 0 
XMUVI 
Y CR CG 
I KUT D 


I 
I 
I I 
'-' 
I 
• 
....-.... ..- 


1 HFPRX 
C PC RR 
EHFMU 
HRAXC 
NFDUB 
ATFQR 


2 PRETN 
HEHTT 
DP RI W 
PTVNH 
CRSWY 
VJRFT 
'-' .._,, 
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Starting with any p8J.l' of superimposed letters (begmrung with the 7th pair), chams of eqmva- 
lents are constructed 


1 a a ' s a 7 a o w n u u u 


1----------------- Z 0 B Y 
2----------------- L X N C H P E D S G 
3----------------- Q F R T J U W M I 
4----------------- A V K 


By mterpolation, these partial sequences may be united mto the key-word sequence 


HYDRAULICBEFGJKMNOPQSTVWXZ 


b The lllltl.al key words and the plam texts may now be e.scertamed qmte easily by 


deciphenng the messages, usmg this pnmary component shd agamst itself 
It will be found that 
the lllltial key word for the 1st message is PENCE, that for the 2d lB LATERAL 
The reason that 
the cryptographic texts are ISomorphic beyond the lDltlal key word portions is, of course, that 
smce the text beyond the key word is enciphered auto-key fashion by the precedmg Cipher letter 
the letters before the le.st letter of the key have no effect upon the enciphenn.ent at all 
Hence 
two messages of identical text cannot be other than ISomorphic after the lDltl.al key-word portions 


c The foregomg solution affords a clue to the solution of cases m whJ.ch the texts of two 
or more messages are not completely identical but are m part identical because they happen to 
have smular begm.mngs or endings, or contam nearly Simtlar mformatl.on or mstructions 
The 
progress ID such cases IS not so rapid as ID the case of messages with wholly identl.cal texts because 
much care must be exercised ID blockmg out the isomorphic sequences upon which the recon- 
structl.on of the pnmary components will be based 
d (1) In the foregomg cases, the primary components used to encipher the illustrative 


messages were identical mixed sequences If nomdentical components are employed, the 
cryptograms present an mterestmg case for the apphcation of a prmciple pomted out m a 
precedmg text ' 


(2) Suppose that the three messages of paragraph 27b had been enciphered by usmg a 
plam component different from the nuxed component 
The encipherments of the word 
ARTILLERY would still yield isomorphic sequences, from which, as has been noted, the recon- 
struction of the cipher component can be accomplished 


(3) Havmg reconstructed the cipher component (or an eqwvalent) the latter may be 


applied to the cipher text and a "decipherment" obtamed 
In th.ls process any sequence of 26 
letters may be used as the plam component and even the normal sequence A 
Z may be 
employed for tlus purpose 
The word decipherment m the next to the last sentence 18 enclosed 
by quotation marks because the letters thus obtamed would not yield plam text, smce the real 
or an eqwvalent plam component has not yet been found 
Such "deciphered" text may be 
termed spurious plam text 
But the important thing to note is that this text is now monoalphabetic 


and may be solved by the simple procedure usually employed in solving a monoalphabetw cipher 
produced by a single mixed alphabet 
Thus, a. polyalphabetic cipher may be converted to mono- 


alphabetl.c terms and the problem much srmphfied 
In other words, here IS another example 
of the Sltue.tions m wluch the pnnciple of convel'Slon IDto monoalphabetic terms may be apphed 
with gratifying success 
It IS ali:.o an example of the dictum that the use of two differently 
mixed primary components does not really give much more secunty than does a nuxed component 
shdlng against itself or aga.mst the normal sequence 


'Muitar11 Cr11ptanal11n•, Part II, par 41511 


I I 
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e (1) If the auto-key method shown m paragraph 23c (2) had been employed m enr1phenng 
the two identical te""{ts above, the solution would, of course, have been a bit more difficult 
To 
illustrate such a case, let the two texts be enciphered by key words of the same lengths but 
d1fterent compos1t10ns PENCE and LATER 
Thus 


No 1 
Key ________ P E N C E 
T S B J S MMNRU LP U I H J BT X F INN RM 
Plnm _______ RE QUE S T I N F 
0 RM AT I 0 N 0 F 
S I T U A 
T I 0 N I 


Cipher _____ TS BJ S MMNRU L P U I H J BT X F INN RM DWI Q V 
Key ________ DWI Q V PC KA 0 
D P A Z 0 BC MR I 
AF NW 0 
G LI HT 
Plam _______ NF IF T EENTH INF AN TRY SE C T 0 R A 
T 0 N C E 


Cipher _____ P C K A 0 DP AZ 0 BC MR I 
AF NW 0 
G LI HT I W W C U 


No 2 
Key ________ LATER BKKMJ RB TUX S G E B Q YRHHA TETU C 
Plain _______ RE QUE S T I N F 
0 RM AT I 0 N 0 F 
S I T U A 
T I 0 N I 


Cipher _____ BK KM J 
RB TUX S GE B Q YRHHA T E T U C N 0 GT M 


Key ________ N 0 GT M L D Q LE NG BYE W D SUH PUTZ E HHGDK 
Plam _______ N F I F T EENTH I N F A N TRYSE C T 0 R A 
T 0 N C E 


Cipher _____ L D Q LE NG BYE W D SUH P U T Z E HHGDK T 0 DEX 


(2) Now let the two cryptograms be supenmposed and 1somorphlsms be sought Tbey are 
shown underhned below 
1------------- T S B J S MMNRU L P U I H J BT X F INN RM DWI Q V 
2 _____________ BKKMJ RB TUX S g EB Q YRHHA TETU C NQQTM 
1 _____________ PC KA 0 
D P A Z 0 BC MR I 
AF NW 0 
G LI HT I WW CU 
2 _____________ L!2,QL:§i NQBY~ W!2,SQH 
PUIZ~ HHQDK TQDEX 
It will be noted that the mtervals between 1somorphlc superimposed pRll's show a constant 
factor of 5, mdlcatmg a 5-letter mt1al key word 
(3) A reconstruction diagram for the pans beyond the first five letters is estabhshed, based 
upon thls mterval of 5, and is as follows 


A B C D E F G H I 
J K L M N 0 P Q R S T U V W X Y Z 


p w 
N 
H 
T y D s R 
L I 
0 
F G 
- - - - - - - - - 
"--- - 
- - - - - - - - ,_ - - - - - ,_ 
x R D 
u 
H B E 
G 
w 
0 p 
- - - - - - - - - - - - - - - - - - - - - - - - - ,_ 
B K 
I 
N 0 
G 
Q 
s T 
w x c 
H E 
D R 
- - - - - - 
- - - - - - - - - - - - - - - - - - - ,_ 


L F E A 
D B 
N c 
p 
s T u 
w 
z H 
y 
- - 
- 
- - - 
- - - - - - - - - - - - - - - - - - - ,_ 
w D 
T 
A u Q H 
I 
c B E F G 
K x M N 0 


The equivalent sequence A W N B D T K I H Q G U X 0 E R V M C Y S J L Z P F IS 
estabhshed by mdlrect symmetry, from thls, by dccunat1on on the eleventh mterval, the 
HYDRAULIC 
XZ component is recovered 
(4) It will be noted that the foregomg case, m whlch the rmtial key words for the two crypto- 
grams are of the same length, is only a spec.1al epphcation of the method set forth m paragraph 
44 of M1htary CryptanalysIS, Part II But if the key words were of different lengths, the method 
set forth m part1.graph 45 of the text referred to would be applicable 
No example is deemed 
necessary, smce no new prmc1ples are mvolved 
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30 Prehmmary rema.rks on plam-text auto-keymg -a If the oiphe1 alphabets are unknown 


sequences, plain-text auto-keymg gives nse to cryptograms of more mtnoate character than 
does cipher-text auto-keymg, as has already been stated 
As a cryptographlc pnnciple it IS 
very commonly encountered as a new and remarkable "mvention" of tyros m the cryptographlc 
art It apparently gives nse to the type of ree.sonmg to wluch attention has been dlrected 
once before and which was then shown to be a popular delUSion of the ummtiated 
The noVIce 
to whom the auto-key pnno1ple comes as a bnlhe.nt flash of the imagmation sees only the apparent 
imposS1bihty of penetrating a secret whlch enfolds another secret 
His reasomng runs about 


as follows "In order to read the cryptogram, the would-be solver must, of course, first know 
the key, but the key does not become known to the would-be solver until he has read the crypto- 
gram and has thus found the plain text 
Smee th.IS IS reasomng around a cncle, the system IS 


mdec1pherable " How unwarranted such reasomng reelly IS m thls case, nnd how readily the 
problem IS solved, will be demonstrated m the next few paragraphs 


b A consideration of the mechanics of the plain-text auto-key method disclobes that a 
repetition of n letters m the plam text will produce a repetition of (n-k) letters m the cipher 
text, where n represents the length of the repetition and k the length of the mtroduotory key 
Therefore, when the mtroductory key coDS1Sts of a smgle letter there will be as many repetitions 
m the cipher text as there are m the plam text, except for true dlgrapluc repetitions, whlch of 
course disappear 
But on the other hand some "accidental" dlgraphlc repetitions are to be 


fairly expected, smce it can happen that two different plam-text palrB, enciphered by drfferent 
key letters, will produce identical cipher eqmvalents 
Such accidental repetitions will happen 
less frequently, of course, m the case of longer polygraphs, so that when repet1t1ons of 4 or more 
letters are found m the cipher text they may be taken to be true or causal repetitions 
It 1s 
obVIous that m studymg repet1t1ons m a cryptogram of thls type, when the mtroductory key 
is a smgle letter, a 5-letter repetition m the cipher text, for example, represents a 6-letter word, 
or sequence repeated m the plam text 
When the mtroductory key IS k letters m length then 
an n-letter repetition represents an (n+k)-letter repetition m the plam text 


c The discusBlon will, as usual, be dlVIded. mto two pnnc1pal cases (1) when the cipher 


alphabets are known and (2) when they are unknown 
Under each case there may be an mtro- 
ductory key CODS1Stlng of a smgle letter, a word, or a short phrase 
The smgle-letter rmtial 


key will be treated first 
31. Solution of plam-text auto-keyed cryptograms when the mtroductory key is a single 


letter -a Note the followmg plam-text auto-keyed enc1phennent of such commonly encountered 
plam-text words as COMMANDING. BATTALION. and DIVISION. usmg two 1dent1cal prnnary 
components, m thIS case dlrect standard alphabets 


1311922-39----6 
(45) 
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Key text___________ 
B A T T A L I 0 N 
Key text___________ 
D I V I S I 0 NI 


{1) Plru.n text __________ B A T T A L I 0 N 
Plam text __________ D I V I S I O N 
(2) 
Cipher______________ 
B T M T L T W B 
Cipher______________ 
L D D A A W B 
j 


Keytext___________ 
C 0 M M A N D I N G Key text___________ 
C A P T A I N 
(3) Plam text__________ C 0 M M A N D I N G 
Ple.m text__________ C A p T A I N 


Cipher ______________ • Q A Y M N Q L V T 
Cipher______________ 
C P I T I V 


These charactenst1cs may be noted 1 


(1) The cipher equivalent of Ap is the plam-text letter which immediately precedes AP 


(See the two A's m BATTALION, m example 1 above) 
(2) A plam-text sequence of the general formula ABA yields a doublet as the cipher eqwvalent 
of the final two letters 
(See IVI or ISI m DIVISION, example 2 above ) 
(3) Every plain-text tngraph havmg Ap as its central letter yields a cipher eqwvalent the 
last two letters of which are identical with the lnltial and final letters of the plam-text tngraph 
(See MAN m COMMANDING, example 3 above ) 
(4) Every plam-text tetra.graph havmg Ap as the initial and the final letter yields a cipher 


eqwvalent the second and fourth letters of which are identical with the second and thud letters 
of the plam-text tetra.graph, respectively 
(See APTA m CAPTAIN, example 4 above, also ATTA 
m BATTALION, example 1 ) 


b (1) From the foregomg charactenst1cs and the fact that a repetition of a sequence of n 


plam-text letters will yield, m the case of a I-letter mtroductory key, a repetition of a sequence 
of n-l cipher letters, it IS obvious that the Blmplest method of solvmg th.ls type of Cipher lS 
that of the probable word 
Indeed, if the system were used for regular traffic it would not be 
long before the solution would collSlSt merely m refernng to hsts of cipher eqwvalents of com- 
monly used words (as found from prevwus messages) and searchmg through the messages for 
these cipher eqwvalents 
(2) Note how easily the followmg message can be solved 


BECJI 
BTMTL 
TWBPQ 
AYMNQ 
HVNET WAALC 
I ..._....._.... 
I 


Seemg the sequence BTMTLTWB, which 18 on the hst of eqmvalents ma above (see example 1), 
the word BATTALION lS inserted m proper pos1t1on 
Thus 


BECJI BTMTL TWBPQ 
BATTALION 


With this as a start, the decipherment may proceed forward or backward with ease 
Thus 


BECJI 
BTMTL 
TWBPQ 
AYMNQ 
HVNET 
WAALC 
EACHB 
ATTAL 
IONCO 
MMAND 
ERWIL 
LPLAC 
c The foregomg example 18 based upon the so-called Vigen&e method of encipherment 


(0i.:12=0111, 0p11=0012) 
If m enc1pherment the plam-text letter 18 sought m the cipher com- 


ponent, its eqwvalent taken m the plam component (0i.:12=01111 0p12=0e11), the steps m solution 
are identical, except that the hst of cipher eqmvalents of probable words must be modified 
accordmgly 
For mstance, BATTALION will now be enciphered 
by the sequence _________________ ZTAHLXGZ 


1 The student is cautioned that the charactenstics noted apply only to the case where two identical com- 
ponents are used, with the base letter A 
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d If reversed standard cipher alphabets are used, the word BATTALION 


will be enciphered by the sequence ______________________________ -------- 
BHATPDUB, 


which also presents idiomorphic charactenstics leadmg to the easy recogmtlon of the word 
e All the foregomg phenomena are based upon standard alphabets, but when mixed cipher 


components are used and these have been reconstructed, similar observations may be recorded 
and the results employed m the solution of additional messages enciphered by the same com- 
ponents 


32 Example of solution by the probable-word method.--a The solution of messages 
enciphered by unknown mixed components ~ill now be dIScussed by example 
When the pn- 
mary components are unknown, the observations noted under the precedmg subparngraphs are, 
of course, not applicable, nevertheless solution is not drlficult 
Given the followmg three c1ypto- 


grams, all mtercepted on the same day, and therefore suspe<'ted of bemg related 


H U F I I 
UEWHU 
G JP G H 
PH DP R 
WUAVW 
C I F G Z 
R 0 Q 0 J 


JU FI I 
SP KT S 
G 0 V V V 
G 0 V ZS 


F JU HF 
EUBDD 
RHUJU 
TV H NS 
UNMHH 
ZQXAP 
z u v cc 
XMHFF 
UHCBM 


0 c Q J J 
UQHUM 
A Y JD R 
S V K Z P 
YUE Z Q 
u v cc p 
DRUWN 


0 c Q J J 
RZVXT 
KWUHE 
ENDBD 


FKDEN 
RHWUM 
F Z P Q P 
V CC E J 
WK CV G 
QYGPA 
PD KC 0 
KMYHS 
THOFH 


MESSAGE I 


I V Z 0 Z 
RZVQR 
UWNGR 
PP KG S 
X AP Q Y 
DK CW V 
GRYSK 


MESSAGE II 


I V Z 0 Z 
WFMRF 
ND B DD 
DRHWU 


MESSAGE III 


ALUPZ 
RHVGP 
Y QC Y H 
PE AMP 
D SW J A 
RPZVX 
G J W Z H 
TBS KC 


V P D G 0 
U AK VD 
Y SK BL 
LL PR V 
GP S VS 
XTWFM 
BL 


I BF E J 
Q H HF 0 
RHWUN 
NP PK P 


KQMVB 
DNCUJ 
0 E Q Z V 
AP 0 E P 
E Q Z BU 
CF NRA 
AP U F Z 
VRQIJ 


VVVKW 
N NEZ V 
Q VU X N 
RBHAK 
FNRAK 
RFKBV 


SUB R J 
RF JP D 
KC MP D 
E Q 0 Y 


J WV PK 
CD Z CY 
X KC Q F 
B HM VJ 
FFYUE 
K C I F G 
FVHAV 
Y C P Z H 


b (1) There are many repetitions, theu mtervals show no common factor, and a uniliteral 


frequency d1Btnbut1on does not appear to be monoa.lphabetic 
Plam-text auto-keying is sus- 


pected 
The simplest assumption to make at the start is that smgle-letter mtrodu<'tory keys 


are bemg used, with the normal Vigen~re method of encipherment, and that the plam component 
is the normal sequence 
Attempts to solve any of the messages on the assumption that the 


cipher component 18 also the normal sequence bemg unsuccessful, it 18 next as•mmed that the 
cipher component is a mixed sequence 
The 13-letter repetition J D R U W N G R Y S 


K B L and the IO-letter repetition P D G 0 V V V K W U are studied mteilSlvely 
If a 
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smgle-letter mtroduotory key 18 bemg used, then these repetitions mvolve 14-letter a.nd 11-letter 
plain-text sequences or words, If the normal V1genfil'e method of encipherment 18 m effect 
(0t12=011i, 0D11=0012), then the base letter 18 A If the latter IS true then a good word wluch 
would fit the 13-letter repetition IS 


KeY------------------ 
R E C 0 N N A I S S A N C E 
Plmn t;ext__________ R E C 0 N N A I S ~ 
A N C E • 


Cipher_______________ 
J D R U i1! G R ~ 
K B L 


and a good word which would fit the IO-letter repetition 18 


KeY--------------------- 
0 B S E R V A T I 0 N 


Plam text;____________ 0 B S E R l!. A T I 0 N • 
Cipher_________________ 
P D G 0-Vl! V K W U • 


(2) lnsertmg, m a nuxed component, the values given by these two assumptions yields 


the followmg 


Plmn ____________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


Cipher __________ {: 
~ 
~ 
S T I N G B C 
K L O p 
V W 
Y 


(3) It 18 a Simple matter to combme these two partial cipher components mto a smgle 
sequence, and the two components are as follows 


Plmn___________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher _________ R E A D J U S T I N G B C F H K L M 0 P Q V W X Y Z 


(4) With the primary components at hand, solution of the messages 18 now an easy matter 
c The foregomg example uses an unknown JIUXed mpher component &b.dmg &g&lllSt what 
was first assumed (and later proved) to bethenormaldirectsequenee 
Whenbothprima.ryeom- 


ponents are unknown nuxed sequences but are identical, solution 18 more drlfieult, naturally, 
because the results of assummg values for repeated sequences cannot be proved and establ!Shed 
so qIDekly as m the foregomg example 
Nevertheless, the general method mdiee.ted, and the 


apphee.tion of the prmciples of mdlreet symmetry will lead to solution, If there 18 a. fall' amount 
of text available for study 
When an mtroduetory key of several letters 18 used, repetitions 


are much reduced and the problem becomes still more drlficult but by no means msurm.ountable 
Space forbids a dete.tled treatment of the method of solvmg these oases but it IS behaved that 
the student 18 m a position to develop these methods and to experiment with them at hlS leisure 


33. Concluchng remarks on the solution of auto-key systems -a The type of solution 
elucidated m the precedmg paragraph 18 based upon the euocessful o.ppheatJ.on of the probe.ble- 
word method 
But sometimes the latter method fe.tls because the commonly expected words 
may not be present after all 
Hence, other prmeiples and methods may be useful 
Some of 
these methods, useful m special cases, are almost meeha.ru.eal m thell' nature 
ExtenS1on of the 
baSle pnnmples mvolved may lead to rather far-ree.ehmg eompleXJ.ties 
However, because these 
methods are appheable only to somewhat special Situations, and because they are somewhat 
mvolved they will be omitted from the text proper and placed m Appendix 1 
The student 
who 18 especially mterested m these cases may consult that appendix at lus lmsure 


b. It 18 thought that suffieient attention 11as been devoted to the solution of both cipher-text 
and plam-text auto-key systems to have demonstrated to the student that these cryptographic 
methods have senous weaknesses w hieh exclude them from practical usage m military cryptog- 
raphy 
Besides bemg comparatively slow and subJect to error, they are rather easily solvable, 
even when unknown mpher alphabets are employed 


c In both systems there are eharactemties which perrmt of identJ.fymg a. cryptogram as 
belonging to tlus class of substitution 
Both eases will show repetitions m the cipher text 
In 


cipher-text auto-keying there will be far fewer repetitions than m the ongmal pla.m. text, especially 
when mtroduetory keys of more than 1-letter m length are employed 
In plam-text auto-keymg 
there wtll be nearly as many repetitions m the cipher text as m the ongmal plam text unless 
long mtroduetory keys are used 
In either system the repetitions will show no constancy as 


regards mterval& ~ 
them, 811'.ld a untliteral frequency d1Stnbution will show such messages 
to be polyalphabetie m nature 
Cipher-text auto-keymg may be distmgmshed from plmn-text 
e.uto-keymg by the appearance of the frequency dlStnbution of the second member of sets of 
two letters separated by the length of the mtroduetory key (see par 25h) 
In the ease of cipher-- 


text auto-keymg these frequency dlStnbutions will be monoalphabetie m nature, m plam-text 
auto-keying such frequency dtstnbutions wtll not show monoalphabet1c ehe.raetensties 


8EOTJON IX 


METHODS OF LENGTHENING OR EXTENDING THE KEY 


PrehDllnary remarks ------------------------------------------------------------------------------- ___ 
Parlgla;: 
Extended and nonrepeatmg keys, the so-called "runmng-key system"_ 
_ 
- 
----------------- 
35 
Other systems employmg lengthy keying sequences---------------------------~~---::::::::::::::::::::=::::::::.:::::::::: 36 


34 Prehmmary remarks -In paragraph lb of thIS text 1t was stated that two proc.edures 


suggest themselves for ehmmatmg the weaknesses introduced by penod1c1ty of the type pro- 
duced by Simple, repeatmg-key methods 
The first of these, when studied, embraced some of 
the very sunple methods of suppressmg or destroymg penod1c1ty, by such devtces as mterruptmg 
the key and usmg vanable-length groupmgs of plam text It was demonstrated that subter· 
fuges of this sunple nature are madequate to elunmate the weaknesses referred to, and must be 
discarded m any system intended to afford real secunty 
The other alternative suggested m 


paragraph lb therefore rema.ms now to be investigated, viz, that of lengthemng the keys to a 
pomt where there would seem to be an msuffictent amount of text to enable the cryptanalyst to 
solve the traffic 
Attempts toward this end usually consISt m extendmg the key to such a length 
that the enemy cryptanalysts will have only a very hmited number of penods to work with 
The key may, mdeed, be lengthened to a pomt where it becomes as long as, or longer than, the 
text to be enciphered, so that the key 1s used only once 


35 Extended and nonrepeatmg keys -a It is obvious that one of the simplest methods of 
lengthemng the key to a message IS to use a long phrase or even a complete sentence, provided 
it is not too long to remember 
In addition to the dlfficult.tes that would be encountered m 


practical nuhtary cryptography m selecting long mnemomc phrases and sentences wluch would 
have to be unparted to many clerks, there is the fact that the probable-word method of solution 
still remams as a. powerful tool m the hands of enemy cryptanalysts 
And If only a word or 
two of the key can be reconstructed as a result of a fortunate assumption, it IS obvious that the 
enemy cryptanalysts could readily guess the entire key from a fragment thereof, smce any long 
phrase or sentence which 1s selected because 1t can eastly be remembered IS hkely to be well 
known to many people 


b There are, however, more or less Simple methods of employing a short mnemomc key m 
order to produce a much longer key 
B8.Slcally, any method of transpoSit1on apphed to a smgle 


alphabetic sequence repeated several tunes will yield a. fairly long key, wluch, moreover, has the 
advantage of bemg umntelligible and thus approachmg a random selection of letters 
For 
example, a numencal key may be denved from a word or a short phrase, this numencal key may 
then be apphed as a columnar-transp0S1t1on key for a rectangle withm which the normal a.Iphabet 
has been repeated a preVIously agreed upon number of tunes m a norm.al (left to nght) or pre- 
arranged manner 
The letters when transcnbed from the transpos1tion rectangle then become 
the successive letters for enC1phenng the plam text, usmg any desired type of pnmary com- 
ponents 
Or, if a smgle transpoSition IS not thought to be sufficiently seeure, a double trans- 
poSition will yield a still more nuxed up sequence of key letters 
Other types of transpos1t1on 
may be employed for the purpose, mcludmg vanous kmds of geometnc figures 
Also, a non- 
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transpoSit.ton method of lengthemng the keymg sequence and at the same tune mtroducmg an 
UTegulanty, such as apenodic mterruption has already been descnbed (see par 18) 
c Another method of developmg a long key from a short mnemomc one is that shown below. 


Given the keyword CHRISTMAS, a numencal sequence is first denved and then one wntes down 
succesSive sections of tlus numencal key, these sections tennmatmg with the succeso;ive num- 
bers 1, 2, 3, 
of the numencal key 
Thus 
Mnemoruc key_______ C H R I S T M A S 
Numencal key ______ 2-3-6-4-7-9-5-1-8 


Extended key_______ C H R I S T M ! I 
~I C ~I C H R ~I C H R I S T : IC H ~I 


c HR I ~le HR I s TM A ~le HR I s ii 


Thus the ongmal key of only 9 letteis is expanded to one of 45 letters (1 +2 +a+ 
+9=45) 
The fonger key is also an mterrupted key of the type noted under paragraph 17, but rl the mes- 
sage IS long enough to requue several repetitions of the expanded key the enc1pherment becomes 
penodl.c and can be handled by the usual methods employed m solvmg repeating-key ciphers 
If the b8Slc key lS fauly long, so that the expanded key becomes a qwte lengthy sequence, then 
the message or messages may be handled m the manner cxplam.ed m paragraph 20 
d Another method of producmg a rather long sequence of digits for keymg purposes from a 


emgle key number IS to select a number whose reciprocal when converted by actual division mto 
its equivalent decunal yields a long senes of digits 
For example the reciprocal of 49, or 1/49, 


yields a. sequence of 42 dlglts begm.mng 02040815 
Such a number, coupled with a. 


key word hke CHRISTMAS, could be used for mterrupted keymg, the successive cipher alphabets 
bemg used for enciphering as many letters as are indicated by the successive digits 
In the case 


of the example cited, the :first digit is O, hence the C alphabet would not be used 
The next 


chglt lS 2, the H alphabet would be used for enc1phenng the first and second letters 
The third 
digit lS agam O, the R alphabet would not be used 
The fourth digit IS 4, the I alphabet would 
be used for enciphenng the tlurd, fourth, fifth, and sixth letters, and so on 


36. Other systems employing lengthy keying sequences -a The so-called "runn/1,ng..Jcey" 
81/Btem-To be mentioned m connection with tins subJect of extensive or lengthy keys IS the 
ctpher system known as the runmng-key, continuous-key, or nonrepeating-key system, m which 
the key conSlsts of a sequence of elements which never repeats no matter how long the message 
to be enciphered happens to be The most common and most practical source of such a key 18 
that m which the plam text of a previously agreed-upon book serves as the source for succesSlve 
key letters for encipherment 1 The solution of thIS type of cipher, an accomphshment which was 
once thought Impossible, presents some mterestm.g phases and will be considered shortly At th.ls 
pomt it IS merely desired to mdicate that accordmg to the running-key system the key for an 
mdlvidual message mo.y be o.s long as the message and never repeat, but If a. large group of 
correspondents employ the same key sequence, it may happen that there will be several messages 
m the same key and they will all begin with the same 1Dlt1al key letter, or, there will be several 
which will "overlap" one another with respect to the key, that 18, they begm at different m1tial 
points m the keymg sequence but one message soon overtakes the other, so that from that pomt 
forward all subsequent letters m both messages are enciphered by the same sequence of key 
letters 


1 Sec IX, Advanced Military Cryptography 
Bee also footnote 8, page 71 of tJus text. 
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b The so-ca&d progressive-alphabet sy8'em -In the so-called progressive-e.lphabet system 
the baSic pnnc1ple IS qmte sunple 
Two or more primary elements are arranged or provided 


for according to a key which may be vaned from tune to tune 1 the mteraction of the pnmary 
elements results m mak:mg available for cryptographic purposes a set of cipher alphabets, all 
the latter are employed m a fixed sequence or progression, hence the designation progresSive- 
alphabet system If the number of alphabets available for such use IS rather small, and 1f the 
text to be enciphered IS much longer than the sequence of alphabets, then the system reduces 
to a penod1c method 
But If the number of alphabets is large, so that the sequence is not 
repeated, then of course, the cryptographic text will exlub1t no penodic phenomena 
c The senes of cipher alphabets m such a system constitutes a keymg sequence 
Once set 
up, often the only remammg element m the key for a specific message IS the sta.rtmg pomt m the 
sequence, that is, the 1mt1al cipher alphabet employed m enc1phenng a given message 
If this 


keymg sequence must be employed by a large group of correspondents, and If all messages 
employ the same startmg pomt m the keymg sequence, obviously the cryptograms may simply 
be superimposed without any prehmmary testing to ascertam proper pomts for supenmpos1t10n 
The student has already been shown how cases of thIS sort may be solved 
However, if messages 
are enciphered with varymg starting pomts, the matter of supenmpoSing them properly takes 
on a dlfterent aspect 
Thls wtll soon be treated m detail 


d The respective cipher alphabets constituting the entire complement of alphabets may 
be employed ma simple progresSion, that is, consecutively from a preselected rmt1e.I pomt or 
they may be employed according to other types of progression 
For example, If the systeU: 
comprises 100 alphabets one might use them m the sequence I 3 5 7 
or I 4 7 IO 
or irregular types of skipping may be employed 
' ' ' ' 
' 


1 


' 


1 
1 


' 


e In addition to the foregoing, there are, of course, a great many mechamcal methods of 


produCing a long key, such as those employed m mechamcal or electrical cipher machmes 
In 
most cases these methods depend upon the mteract1on of two or more short, pnmary keys whlch 
JOmtly produce a smgle, much longer, secondary or resultant key 
(See par 4) Only bnef 
reference can be made at this pomt m the cryptanalytic studies to cases of thIS kmd 
A detailed 


treatment of complex e~amples would reqmre much tune and space so that it will be reserved 
for subsequent texts 
f Fmally, there must be mentioned certam devices m which, as m encipherment by the 
auto-key method, the text itself serves to produce the variation m cipher eqmvalents, by con- 
trollmg the selection of secondary alphabets, or by mfluencing or determrmng the sequence with 
whlch they will be employed 
Naturally, m such cases the key is automatically extended to a 


pomt where it comc1des m length with that of the text 
.An excellent example of such a device 
is that known as the Wheatstone, the solution of whlch will be descnbed m its proper place 2 
Some wnters clasSify and treat thIS method as well as auto-key methods as forms of the runnmg- 
key system but the present author prefers to conSider the latter as bemg radically different m 
pnnciple from the former types, because m the true runnmg-key system the key is wholly external 
to and mdependent of text being enciphered 
Thls 18 hardly true of auto-key systems or of 
systems such as the Wheatstone mentioned herem 


1 See See XII, Ad11anced Miltta1'1/ Cr'l/ptograph1J 


SECTION x 


GENERAL PRINCIPLES UNDERLYING SOLUTION OF SYSTEMS EMPLOYING LONG 
OR CONTINUOUS KEYS 
Paragraph 
Solution when the primary components are known sequences _ ---------------------------------------------------------- 
37 


Solution of a runnmg-key cipher "hen an unknown but intelligible key sequence is used and the primary 
components are kno" n ______________________________________________ --------- _ __ _ _ _ _ _ _ _ _ _ _ __ _ _ 38 


Solution of a progressive-alphabet cipher when the primary components are known _______ ------------------------ 
39 
General solution for ciphers mvolvmg a long keymg sequence of fixed length and oompoe1t1on. ---------------- 
40 


37 Solution when the pnma.ry components are known sequences --a As usual, the solution 
of cases mvolvmg long or contmuous keys will be treated under two headmgs Fm!t, when the 
pnme.ry components a.re known sequences, second, when these elements are wholly unknown 
or partially unknown 
b Smee the essential purpose m USing long keys IS to prevent the formation of repetitive 


cycles withm the text, it IS obvious that m the case of very long keymg sequences the crypt- 
analyst is not gomg to be able to take the text and break it up mto a number of small cycles 
whlch wtll perrmt the establishment of monoalphabetlc frequency d1stnbutions that can readily 
be solved, an end whlch he can attam all the more readily If to begm with he knows the prunary 
sequences 
But, there nearly always remains the cryptanalyst's last resort the probable-word 
method 
Inasmuch as this method is applicable to most of these cases, even to that of the 


runnmg-key system, which perhaps represents the furthest extension of the pnnc1ple of long 
keymg sequences, an example usmg a cryptogram of the latter type will be studied 


38 Solution of a runmng-key mpher when an unknown but mtelhgible key sequence 
is used and the pnmary components are known -a In paragraph 36a mention was made of 
the so-called running-key, contmuous-key, or nonrepeating-key system, m which the plam text 
of a previously agreed-upon book serves as the source for succesmve key letters for enc1pherment 
Smee the runmng-key system IS entirely apenodic, and the cipher text can therefore not be 
arranged m supenmposed short cycles, as m the case of the repeating-key system, it would 
appear on first conSideration to be "mdec1pherable" without the key 1 But If the student 
Wiii bear m rmnd that one of the practical methods of solvmg a repeatmg-key cipher 18 that of 
the probable word, 2 he nll immediately see that the latter method can also be apphed m 
solvmg thls type of nonrepeatmg-key system 
The essence of the matter is this The 
cryptanalyst may assume the presence of a probable word m the text of the message, if he 
knows the pnmary components mvolved, and if the assumed word actually eXISts m the message, 
he can locate it by checkmg agamst the key, since the latter is intelligible text 
Or, he may 


assume the presence of a probable word or even of a phrase such as "to the," "of the," etc, 
m the key text and check his assumption agamst the text of the message 
Once he has forced 


1 At one time, mdeed, tlus view was current among certain cryptographers, who thought that the pnnc1ple 
of factonng the intervals between repetitions m the ease of the repeatmg-key Cipher formed the basIS for the 
only possible method of eolvmg the latter type of system 
Smee, according to thle erroneous idea, factonng 


cannot be applied m the case of the runmng-key system (usmg a book as the key), therefore solution was con- 
&ldered to be impossible 
How far this idea is from the truth will presently be seen 
In thle same connection 


see also footnote 8, page 71 


•See Mdit~ Cryptanalytna, Part II, par 25 
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such an entenng wedge mto either the message or the key, he may butld upon thlS foundation 
by extendmg lus assumptions for text alternately m the key and m the message, thus gradu- 
ally reconstructing both 
For example, given a cryptogram contammg the sequence 


HVGGLOWBESLTR 
, suppose he assumes the presence of the phrase THAT THE m the key text 
and finds a place m the plam text where thlS yields MMUNITI 
Thus, usmg reversed standard 


<'tphE>r alphabets 


Assumed key text ______ ----------- 
T H A T T H E 


Cipher text _______________ ------------ 
H V G G L 0 W B E S L T R 
Resultant plam text_________________ 
M M U N I T I 


This suggests the word AMMUNITION 
The ON m the cipher text then yields PR as the begin- 


mng of the word after THE m the key text 
Thus 
Assumed key text __________________ _ 
Cipher teict ___________________________ _ 
Resultant plam text ________________ _ 


THATTHEPR 
HVGGLOWBESLTR 
MMUNITION 


PR must be followed by a vowel, with 0 the most hk.ely candidate 
He finds that 0 yields VI 
m the plOJn text, which suggests the word WILL 
The latter then yields OTEC m the key, 


maJnng the latter read THAT THE PROTEC 
Thus 
Assumed key text ___________________ _ 
Cipher text ___________________________ _ 
Resultant plam text ________________ _ 


THATTHEPROTEC 
HVGGLOWBESLTR 
MMUNITIONWILL 


This suggests the words PROTECTION, PROTECTIVE, PROTECTING, etc 
Thus extendmg one 
text a few letters serves to "coerce" a few more letters out of the other, somewhat as m the case 
of two boys who are runnmg approximately abreast ma race, as soon as one boy gets a bit ahead 
the spmt of competition causes the other to overtake and pass the :first one, then the latter puts 
forth a little more effort, overtakes and passes the second boy 
Thus the boys alternate m 


overtaking and passmg each other until the race is run 
The only pomt m wluch the Slmtle 
fails 18 that whtle the boys usually run forward all the time, that IS, m a smgle direction, the 
cryptanalyst 18 free to work m two directions-forward and backward from an mternal pomt 
m the message 
He may, m the case of the example cited above, continue h1S butldmg-up 
process by addmg A to the front of MMUNITI as well as ON to the rear If he reaches the end of 
lus resources on one end, there remains the other end for expenmentat1on 
He 18 certainly 


unlucky if both ends termmate m complete words both for the message and for the key, leaving 
him without a smgle clue to the next word m either, and torcmg lum to a more mtens1 ve use 
of lus rmagmation, gwded only by the conte.'l:t 
b In the foregomg illustration the cryptanalyst lB assumed to have only one message 


available for h1S expenmente.t1on 
But If he has two or more messages wluch mther begin at 


identical rmtial pomts with reference to the key, or overlap one another with respect to the key, 
the reconstruction process descnbed above IS, of course, much easier and is accomplished much 
more qmckly 
For if the messages have been correctly S'Ulpmmposed wi.th reference to the key te:d, 
the additwn of one or two letters to the key yields 8'U{Jgestions for the asB'Umptwn of words in several 
messages 
The latter lead to the addition of several letters to the key, and so on, m an ever- 


widenmg Cll'cle of ideas for further assumptions, smce as the process continues the context 
affords more and more of a hams for the work 
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c Of course, if suffi.Cient of the key text lB reconstructed, the cryptanalyst rmght 1dentlly 


the book that IS bmng used for the key, and If available, h1S subsequent labors are very much 
s1mplllied 
d All the foregomg is, however, dependent not only upon the use of an mtellig1ble text as 
the keymg text but also upon havmg a knowledge of the pnmary components or cipher alpha- 
bets employed m the enc1pherment 
Even If the pnmary components are differently mixE>d 


sequences, so long as they are known sequences, the procedure 18 qwte obvious m view of 
the foregomg explanation 
The tram.mg the student has already had IS believed sufficient to 


mdicate to lum the procedure he may follow m that solution, and no further details will here be 
given m respect to such cases 
But what If the pnmary components are not known sequences? 


ThIS contingency will be treated presently 
39. Solution of a. progressive-alpha.bet cipher when the cipher alphabets are known -a 
Takmg a very surple case, suppose the mteracting elements referred to m paragraph 366 consist 
merely of two pnma.ry Cipher components which shde agamst each other to produce a set of 26 
secondary cipher alphabets, and suppose that the srmplest type of progresSion 1B used, mz, the 
cipher alphabets are employed one after the other consecutively 
Beginrung at an rmt1al 
JUXtapos1t1on, producmg say, alphabet 1, the subsequent secondary alphabets are m the sequence 
2, 3, 
26, 1, 2, 3, 
, and so on If a different 1mtial JUxtapomtion 1s used, say alpha.bet 10 


18 the :first one, the sequence IS exactly the same as before, only begmnmg at a different pomt 


b Suppose the two pnmary components are based upon the keyword HYDRAULIC 
A 


message IS to be enCiphered, beginnmg with alphabet 1 
Thus 


Plam component __________ H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z H Y D 
Cipher component _______ H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z 
Letter No ___________________ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 
Alphabet No ______________ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 
Plam text___________________ E N E M Y H A S P L A C E D H E A V Y I 
N 


Cipher text_________________ E 0 G P U U E Y H M K Q V M K Z S 
J 
Q H 
E 
Letter No ___________________ 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 
Alphabet No ______________ 22 23 24 25 26 1 
2 
3 
4 
5 
6 
7 
8 
9 10 11 12 13 


Plam text___________________ T E R D I 
C T 
I 
0 
N F 
I 
R E U P 
0 
N 


Cipher text_________________ N L 
H H L 
C V B 
S 
S 
N J 
E P 
K D D D 
Letter No ___________________ 40 41 42 43 44 45 46 47 48 49 50 51 52 53 
Alphabet No _______________ 14 15 16 17 18 19 20 21 22 23 24 25 26 1 
Plam text___________________ Z 
A N E S 
V I 
L 
L 
E R 0 
A D 


Cipher text·---------------- 
G P 
U H F 
K H H Y L 
H M R D 


c ThIS method reduces to a penod1c system mvolvmg 26 secondary mpher alphabets and 
the latter are used m srmple progression 
It is obvious therefore that the 1st, 27th, 53d, 
letters are m the 1st alphabet, the 2d, 28th, 54 th, 
letters are m the 2d alphabet, and so on 


d To solve such a cryptogram, knowmg the two prrmary components, is hardly a problem 
at all 
The only element la.clang 18 a knowledge of the starting pomt 
But thIS 18 not neces- 
sary, for merely by completmg the plOJn-component sequences and exammmg the diagonals of 
the diagram, the plam text becomes evident 
For example, given the folloWlllg H I D C T 
EH U XI Completing the plain-component sequences rmtiated by the successive cipher letters, the 


plam text, E N E M Y M A C H I 
is seen to come out m succeBSIVe steps upward in Figure 
10 
Had the cipher component been slufted m the oppoSite direction m enc1pherment, the steps 
would have been downward mstead of upward If the shdmg stnps had been set up accordmg to 
the sequence of cipher letters but on a diagonal, then, of course, the plam-text letters would 
have reappeared on one generatnx 


e The student will understand what sun.pie mod.J.fications m 
procedure would be reqmred m case the two pnmary components 
were dllferent mixed sequences 
But what if the pnmary com- 
ponents are not known sequences? How does the cryptanalyst 
proceed m that case? 


40. General solution for ciphers mvolvmg a long·keymg 


sequence of :fixed length and compos1t1on --a It IS obvious, as 
stated at a preVIous pomt, that no matter how the keymg sequence 
is denved, if all the correspondents employ the same key, or 'if this key v 
'UBed many times by a single office, and if it always begins at the same 
point, the iarw'UB messages may simply be 8'Uperimposed 
Thus, their 
respective 1st, 2d, 3rd, 
letters wtll all fall withm columns 


which have been enciphered by the 1st, 2d, 3rd, 
key letters 
If there lS a sufficient number of messages, solution then becomes 
possible by frequency analysis of the succesSlve columns-nomatter 


HIDCTEHUXL 
YCRBVFYLZI 
DBAEWGDIHC 
REUFXJRCYB 
AFLGZKA 
DE 


UGIJHY' 
ERF 
LJCKYNLFAG 
IKBYDOIGUJ 
CMENRPCJLK 
BNFOAQBKIM 
EOGPUSEMCN 
FPJQLTFNBO 
GQKSIVGOEP 


:r1ava .. 10 


how long the keymg sequence may be, and regardless of whether the keymg sequence constitutes 
mtelhgible text or IS a purely random sequence of letters 
This method of solution by supenmpo81- 


tion has already been outlined m paragraph 20 and no further reference to it need here be made 


b But now suppose that the keymg sequence does not always begm at the same pomt for 
all messages 
Suppose the several correspondents are able to select at wtll any pomt m the 
keymg sequence as the pomt of departure m encipherment 
Thus, such a keymg sequence, if re- 
garded as partakmg of the nature of a cl.l'cle, wtl1 afford as many possible starting pomts as there 
are letters or characters m that sequence 
Now if there are no external mchcations or tndicafor1 1 
m the cryptograms pertammg to such a system, such as would afford enemy cryptanalysts direct 
and defimte mformation with regard to the lilltia.l keymg element for ea.ch cryptogram, then it 
would seem as though the superimpomtion of messages (to bnng letters enciphered by the same 
cipher alphabets withm the same columns) would be drllicult or impossible, and therefore that 
attempts at solution are blocked at thell' very begmmng 
ThlS, however, lS not the end of the 
story 
For suppose two of the messages have m common only one polygraph, say of 5 letters, 
these two messages may be Juxtaposed so as to bnng these repetitions mto supenmpos1tion 
Thus, the possession of this long polygraph m common serves to "tie" these two messages to- 
gether or to "mterlock" them 
Then, suppose a shorter polygraph, say of 4 letters, 18 possessed 


m common by one of these two messages and a third message, this wtll serve to tie m the latter 
with the first two 
ExtenBlon of this process, mcludmg the data from shorter repetitions of 
tngraphs and digraphs, wtl1 serve to assemble a whole set of such messages m proper super- 
impoSltion 
Therefore, the first step lS to examme all the messages for repetitions 


1 Ind1oators play an important rOie m practical cryptography 
An indicator J8 a symbol (consisting of a 


letter, group of letters, a figure Ol' a group of figures) wluoh mdloates the apeolfio key used under the general 
oryptograph•o system, or it may indicate whl.oh one of a number of general systems has been used, or it may md1- 
oate both 
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c When such repetitions are found, and if there are plenty of them so that assumptions for 
probable words are easy to make, it 1S clear that the correct assumptions wtll enable the crypt- 
analyst to set up ple.m-cipher eqmvalencies which wtll make it possible to reconstruct the pri- 
mary components 
Dependmg upon the type used, the prmc1ples of dll'ect or mdll'ect sym- 
metry of poSltion wtl1 be very useful m this process 
d But if it happens that there are no polygraphs by means of which two or more messages 
may be tied together and properly eupemmposed, the Blmple methods mentioned m subparagraphs 
a-c cannot here be applied 
However, although the road toward a solution seems to be blocked 
rather effectively, there lS a detour which presents rather mterestmg vistas 
The latter are 


really of such importance m cryptanalyslB as to warrant detailed treatment 


SECTION XI 


THE "COINCIDENCE" OR "ic" TEST 
Parapaph 


The bas10 theory of the comcidence or 1C (kappa) test ------- ----- ------------------ ------------- ---------------------- 
41 
General procedure to be followed m making the 1C test __________ --- ---------------------------------------------------- 
42 


Example of apphcat1on of the IC test ---------------------------- ____ --------- ------- --------------------------------------- 
43 
Subsequent steps ------ ---------------------------------------- ---------- -------------- _____ ------------------ ------------ ------ 
44 


41. The basic theory of the co1nc1dence or" (kappa.) test -a In Appendix 2 of the pre- 
cedmg text 1 certain simple apphcations of the theory of probability were presented for the 
student's conSlderation, by way of pomtmg out to hnn the nnpo1 tant role whl.ch certam phases 
of that branch of mathematics play m cryptanalyslS 
Reference was there made to the subJect 
of coinculences and its s1gmficance m connection with the study of repet1t1ons m cryptograms 
In this section the matter will be pursued a few steps fUither 
b In the appendix referred to, it was shown that the probability of monograpb1c comciden<,e 


(1) m random text employmg a 26-letter alphabet IS 0385, (2) m Enghsh telegrapluc plam text, 
0667 
These two parameters were represented by the symbols "r and icp, respectively 
The 


important role whl.ch these values play m a certam cryptanalytic test will now be explamed 


c One of the most important techmques m cryptanalytics IS that known as applying the 


coinculence or "kappa test " 
ThlB test 18 useful for several cryptanalytic purposes and one of 
the most important of them 18 to ascertain when two or more sequences of letters are correctly 
superimposed 
By the word "correct" m tlus case IS merely meant that the sequences are so 


arranged relative to one another as to facilitate or make posSlble a solution 
The test has for 


its theoretical ba.Sis the followmg circumstances 


(1) If any two rather lengthy sequences of characters are superimposed, it will be found, 
on exa.mmmg both members of the success1ve pairS of letters brought mto vertical JUXtapos1tion, 
that in a certain number of cases the two superimposed letters will coincule 


(2) If both sequences of letters constitute random text (of a 26-letter alpha.bet), there will 


be about 38 or 39 such cases of comcidence per thousand pairS exam.med 
Th18, of course, IS 


because Kr= 0385 


(3) If both sequences of letters constitute plam text, there will be about 66 or 67 such cases 
of comc1dence per thousand pairs exammed 
ThlB 18 because Kp 18 0667 


(4) If the superimposed sequences are wholly monoalphabetic enc1pherments of pla.m 


text by the same cipher alpha.bet, there will still be about 66 or 67 cases of comcidence m each 
1,000 cases exam.med, because m monoalpha.betic substitution there 18 a fixed or unvarymg 
relation between plam-text letters and c1phe1 letters so that for statlStical purposes monoalpha- 
betic cipher text behaves Just the same as if 1t were normal plam text 
(5) Even if the two superimposed sequences are not monoalphabetically enciphered texts, 
but are polyeJ.phabet1c m character, there wtll still be about 66 or 67 cases of identity between 
supenmposed letters per thousand cases exammed, provuled the two sequences really belong to the 
same cryptographic system and are superimposed at the proper point with respect to the keying 
sequence 
The reasons for th18 will be set forth m the succeedmg subpaiagraphs 


1 Military Cryptanalysis, Part II It is recommended that the student refresh his memory by reviewing 


that appendix 


(58) 
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(6) CoDSlder the two messages below 
They have been enciphered polyalphabetically by 
the same two pnmary components shdmg aga.lllSt each other 
The two messages use the same 


keymg sequence, begmmng at the same m1tia.l pomt m that sequence 
Consequently, the two 
messages are identically enciphered, letter for letter, and the only differences between them are 
those occaSloned by differences m plam text 
l 
Alphabets_ ___ -- 
18 
21 
13 
II 
8 
4 
17 
19 
21 
21 
2 
8 
3 
II 
13 
18 
1 
7 
12 
8 


No I Plam text------------ w H E N I 
N T H E c 0 u R s E L 0 N G M 
Cipher ________________ E !L.li B T E y R c x x L Q J 
N z 0 y A w 
l 
Alphabets ________ 
16 
21 
18 
a 
8 
4 
17 
19 
2i 
21 
2 
8 
3 
6 
13 
13 
1 
7 
12 
6 
No 2 Plam text ____________ T H E G E N E R A L A B s 0 L u T E L y 


Cipher ________________ p !L.li T u E B w D J 
L Q H y z p T M Q I 


Note, now, that (a) m every case m which two supenmposed cipher letters are the same, the 
plam-text letters are 1dent1cal and (b) m every case m which two supenmposed cipher letters 
are chfferent, the plam-text letters are d1fterent 
In such a system, even though the cipher 


alphabet changes from letter to letter, the number of cases of identity or comcldence m the two 
members of a pair of superimposed cipher letters will still be about 66 or 67 per thousand cases 
exam.med, because the two members of each pair of superimpot.ed letters are in the same cipher 
al.phabet and it has been seen in (4) that in monoalphabetic cipher text " is the same as for plain 
tm,• mz, 0667 
The two messages may here be said to be supenmposed "correctly," that 18, 
brought mto proper JUXtapoSit1on with respect to the keymg sequence 
(7) But now suppose the same two messages are supenmposed "mcorrectly ," that is, they 


are no longer m proper JuxtapoS1tion with respect to the keymg sequence 
Thus 
l 
Alphabets_ ___ 
16 
21 
18 
Ii 
6 ' 


17 
19 
21 
21 
2 
6 
3 
Ii 
13 
13 
7 
12 


No I Plam text.--------- w H E N I 
N T H E c 0 u R s E L 0 N G 


Cipher ______________ 
E Q N B I 
F y 
R c x x k_g J 
N ~ 0 y 
A 


!Alphabets. _____ 
111 
21 
13 
a 
6 
4 
17 
19 
21 
21 
2 
8 
3 
8 
13 
13 
1 
7 
No 2 Pla.m text _________ 
T H E G E N E R A L A B s 0 L u T E 


Cipher ______________ 
p Q N I u F B w D J 
k__g H y 
~ p T M 


It 18 eVldent that the two members of every pair of supenmposed letters are no longer m the 
same cipher alphabet, and therefore, if two superimposed cipher letters are identical tlus is 
merely an "acC1dent," for now there 18 no baSlc or general ca.use for the smula.nty, such as IS 
true m the case of a correct supenmpoSltion 
The smula.nty, if present, 18, as already stated, 
due to chance and the number of such cases of suntla.nty should be about the same as though 
the two cipher letters were drawn at random from random text, lil which Kr= 0385 
It 18 no 
longer true that (a) m every case m which two superimposed cipher letters are the same, the 
plam-text letters are identical or (b) m every case m which two superimposed cipher letters are 
different, the plam-text letters ~e chfferent 
Note, for example, that the supenmposed T.'s repre- 
sent two different plam-text letters and that the Sp of the word COURSE m the first message g.i.ves 
J 0 whtle the S of the word ABSOLUTELY m the second message gives H, 
Thus, it becomes clear 


that m an mcorrect superrmpoBltion two chff erent pla.m-text letters enciphered by two chfferent 
alphabets may "by chance" produce identical cipher letters, which on supenmpos1tion yield a 


1 The fact that m this case each monoalphabet contains but two letters does not affect the theoretical value 
of 1C, and whether the actual number of coincidences agrees closely with the expected number based upon IC= 
0667 depends upon the lengths of the two superimposed aequen<.es 
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comcidence ha.vmg no external mdica.tions as to disSlmtla.nty m pla.m-text equivalents 
Hence, 


J.f there are no other factors wluch enter mto the matter and wluch might operate to distort 
the results to be expected from the operation of the baSlc factor, the expected number of cases of 
identical cipher letters brought together by a.n mcorrect supenmpoSltion will be determined by 
the value Kr= 0385 


(8) But now note also that in the foregoing mcorrect supenmposition there a.re two Z0's and 
that they represent the same pla.m-text letter L 
Tlus lS occasioned by the fact that the plam- 
text messages happened to have L's m JUst those two places and that the cipher alpha.bet hap- 
pened to be the same both trmes 
Hence, it becomes clear that the same cipher alphabet brought 
mto play twice may "by cha.nee" happen to encipher the same plain-text letter both trmes, thus 
producmg identico.1 cipher letters 
In some systems thlB source of identity m supenmposed 


cipher letters lB of little rmporta.nce, m other systems, it may materially affect the actual number 
of comCidences 
For 1DStance, J.f a. system is such that it produces a long secondary keymg cycle 
composed of repetitions of short pnmary keymg cycles, an mcorrect supenmpoSltion of two 
cryptograms may bnng mto JUxtapoSltion many of these short cycles, with the result that the 
actual number of cases of identical supenmposed cipher letters IS much greater than the ex- 
pected number based upon Kr= 0385 
Thus, tluq source for the production of identical cipher 


letters m an mcorrect superrmpoSltion operates to mcrease the number of cases to be expected 
from the fundamental constant Kr= 0385 


(9) In some systems, where nonrelated cipher alpha.bets are employed, it may happen 


that two identical plam-text letters may be enciphered by two different cipher alphabets wluch, 
"by chance," have the same eqmvalent for the plam-text letter concerned 
This IS, however, 


a function of the particular cryptograpluc system and can be taken mto account when the 
nature of the system lS known 


(10) In general, then, it may be s&d that m the case of a. correct supenmpoSltion the 


probability of identity or comCidence m supenmposed upher letters is 0667, m the case of an 
mcorrect supenmpos1t1on, the probability is at least 0385 and may be somewhat greater, de- 
pendmg upon special circumstances 
The foregomg S1tuat1on and facts make possible what 
has been referred to as the "comc1dence test " 
Smrc tlus test uses the constant K, it lB also 


called the "kappa test " 


d The way m wluch the comc1dence test may be applied will now be explained 
The 
statement that K11= 0667 means that m 1,000 cases where two letters are drawn at random 
from a large volume of plam text, there will be about 66 or 67 cases in wluch the two letters 
comc1de, that is, are identical 
Notlung is specrl:i.ed as to what the two letters shall be, they 
may be two Z's or they may be two E's 
This constant, 0667, really denotes a percentage 
If many companBom of Slllgle letters are made, the letters being drawn at random from among 
those constituting a. large volume of plam text, 6 67 percent of these compansons made will 
yield comc1dences 
So, if 2,000 such compansons are made, the theory indicates that there 
should be a.bout 0667X2,000=133 comCidences, J.f there is sufficient text to permit of makmg 
20,000 compansons, there should be about 1,334 comCidences, and so on 


e Another way of handlmg the matter lS to find the ratio of the observed number of co- 


mCidences to the total number of cases m wluch the event m question might posBlbly occur, 1 e , 
the total number of compansons of supenmposed letters 
When tlus ratio is closer to 0667 
than it lS to 0385 the correct supenmpos1tion has been ascertamed 
Tlus is true because m 
the case of a correct supenmpoSltion both members of each pall' of supenmposed letters actually 
belong to the same monoalpha.bet and therefore the probability of their comc1dmg lB 0667, 
whereas m the case of an mcoITect supenmpoSltion the members of each pair of supenmposed 
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letters belong, as a general rule, to different monoalphabets 8, and therefore the probability of 
theu comciding 18 nearer 0385 than 0667 


J. From the foregomg, it becomes clear that the kappa. test mvolves ascert&nmg the total 
number of compansons that can be made m a given case, as well as ascert8.llllD.g the actual number 
of comcidences m the case under collSlderation 
When only two messages a.re supenmposed, 


th1S 18 easy The total number of compa.nsons that can be made 18 the same as the number of 
superimposed p8.ll'S of letters 
But when more than two messages are supenmposed m a truper- 
impoaition diagram it lS necessary to make a Simple calculation, based upon the fa.ct that n 
11.(n-1 
letters yield 
2 
p8.ll'S or compansons, where n IS the number of letters m the column' For 


3X2 
example, m the case of a column of 3 letters, there are-2-=3 compansons 
Tlus can be 


checked by noting that the 1st letter m the column may be compared with the 2d, the 2d with 
the 3d, and the 1st with the 3d, makmg 3 compansons m all 
The number of compa.nsons per 
column times the number of columns m the superrmpoSltion diagram of letters gives the total 
number of compa.nsons 
The extension of thlS reasonmg to the case where a supenmpoSltion 
diagram has columns of vs.nous lengths IS qmte obvious one merely adds together the number of 
compa.nsons for columns of different lengths to obtam a. grand total 
For convemence, the 


following bnef table lS given 


Number of 
Nnmberor 
Number or 
Number of 
Number or 
Number of 
letter• in 
lettu• '" 
letter• '" 


column 
compar1<,0m 
columu 
lOlllpBr SOD• 
column 
compar1'10n• 


2 
1 
11 
55 
21 
210 


3 
'l 
12 
66 
22 
2H 
4 
6 
lJ 
78 
2J 
253 
5 
10 
14 
91 
24 
276 


6 
15 
l'i 
105 
25 
JOO 


7 
21 
16 
120 
26 
32j 


I 
8 
28 
17 
13b 
27 
J51 
9 
36 
18 
153 
28 
J78 
10 
45 
19 
171 
29 
40b 
20 
190 
30 
435 


g In a.scertammg the number of comc1denc,es m the c,ase of a. column contammg several 


n(n-1) 
letters, it is agam necessary to use the formula 
2 
, only m this case n lB the number ol 


identical letters m the column 
The reasomng, of course, lB the same as before 
The total 


1 The quahfymg phrase "as a general rule" 18 mtended to cover any dl8tort1on m results ocC&Sloned by the 
presence of an unusual number of those cases of coincidence described under subpar c (8) and (9) 


t This has already been encountered (footnote 3, Appendix 2, Military Crypt.analysis, Part 11) 
It lB merely a 


special case under the general formula for ascertallllllg the number of combmat1ons that may be made of n 
c 
,,,, 
different thmgs taken rat a tune, wluch 18 -=-,( 
)I In studying coincidences by the method mdicated, 
nr r n-r 
,,,, 


smce only two letters are compared at a time, r lS always 2, hence the expression rl(n-r)l' wluch lB the same as 


n(n~~~~)l 2> 
1 
, becomes by cancellation of (n-2)1, reduced to n(n;-l) 
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number of comc1dences lB the sum of the number of comc1dences for ea.ch case of identity 
For 
example, m the column shown at the 8lde, contammg 10 letters, there are 3 B's, 2 C's, 4 K's, and 
1 Z 
The 3 B's yield 3 comc1dences1 the 2 C's yield 1 comc1dence, and the 4 K's yield 6 
C 
comcidences 
The sum of 3+1+6 makes a total of 10 comCidences m 45 compansons 
K 
42. General procedure to be followed m makmg the IC test.-a The steps m applymg 
B 
the foregomg prmCiples to an actual case wtll now be descnbed 
Suppose several messages 
K 
enCiphered by the same keying sequence but each begmnmg at a different pomt m that 


Z 
sequence are to be solved 
The indicated method of solution 18 that of supenmpo8ltion, 


K 
the problem bemg to determme Just where the respective messages are to be supenmposed 
C 
so that the cipher text withm the respective columns formed by the superimposed messages 
B 
will be monoalphabetic 
From what has been mdicated above, it will be understood that 
B 
the vanous messages may be shifted relative to one another to many different pomts of 
K 
superm1pos1tlon, there bemg but one correct supenmpoS1tion for each message with respect 
to all the othe1s 
FirBt, all the messages are numbered according to their lengths, the long- 
est bemg asS1gned the number 1 
Comrnencmg with messages 1 and 2, and keepmg number 1 m 


a fixed position, message 2 lB placed under it so that the lllltial letters of the two messages comc1de 
Then the two letters forming the successive p&lrB of supenmposed letters are exammed and the 
total number of cases m which the supenmposed letters are identical IS noted, thlS givmg the 
observed number of comc1dences 
Next, the total number of supenmposed pairB 18 a.scertam.ed, 
and the latter lS multiphed by 0667 to find the expected number of comc1dences 
If the observed 
number of comcidences 1S coilSlderably below the expected number, or if the ratio of the observed 
number of comcidences to the total number of compa.nsons is nearer 0385 than 06b7, the 
supenmpoS1tion lS mcorrect and message 2 lB shifted to the next supenmpoS1tion, that 18, so 
that its first letter 1s under the second of message 1 
Agam the observed number of comCidences 
is ascertamed and is compared with the expected number 
Thus, by shifting message 2 one 
space at a time (to the nght or left relative to message 1) the comcidence test finally should 
mdicate the proper relative positions of the two messages 
When the correct pomt of super- 


rmpoS1tion is reached the cryptanalyst is iarely left m doubt, for the results are sometimes qwtA 
starthng 
After messages 1 and 2 have been properly superimposed, message 3 18 tested first 


agamst messages 1 and 2 separately, and then agamst the same two messages combmed at their 
correct supenmpos1tion 5 Thus message 3 18 shifted a step each time until its correct poS1tion 
with respect to messages 1 and 2 has been found 
Then message 4 18 taken and its proper pomt 
of supenmpoS1tlon with respect to messages 1, 2, and 3 18 ascertamed 
The process 18 continued 


m thlS manner until the correct pomts of supenmpoS1tion for all the messages have been found 
It 18 obvious that as messages are added to the supenmpoS1tion diagram, the determination of 
correct pomts of supenmpoS1tion for subsequent messages becomes progre88lvely more certam 
and therefore eaS10r 


b In the foregomg procedure it 18 noted that there 18 necesS1ty for repeated d1Splacement 
of one message agamst another or other messages 
Therefore, it 18 adVlSable to transcnbe the 
messages on long stnps of cross-section paper, JOllllilg sections accurately if several such stnps 
are necessary to accommodate a long message 
Thus, a message once so transcnbed can be 


shifted to vanous pomts of supenmpoS1tion relative to another such message, without repeatedly 
rewntlng the messages 
c Machinery for automatically comparmg letters m applying the comc1dence test has been 
deVlSed 
Such machines greatly faCihtate and speed up the procedure 


6 At first thought the student IDight wonder why It 18 advisable or necessary to test message 3 against message 
1 and message 2 separately before testing It against the combination of messages 1 and 2 
The first two tests, 


it seems to him, might be omitted and time saved thereby 
The matter will be explained In par 43/ (3) 


1 
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48. Example of apphcat1on of the IC test -a With the foregomg m mmd, a practical example 


will now be given 
The following messages, assumed to be the first 4 of a senes of 30 messages, 
supposedly enciphered by a long keying sequence, but each message commencmg at a different 
pomt m that sequence, are to be arranged so as to bnng them mto correct supenmpos1tion 


MESSAGE 1 


PG LPN 
HUFRK 
SAU Q Q 
A Q YU 0 
ZAK GA 
E 0 Q C N 


PR K 0 V 
HYE I U 
Y NB 0 N 
NF D MW 
Z LUK Q 
A QA HZ 


MG CDS 
LE AG C 
J P I V J 
WV AUD 
BAHM I 
HK 0 RM 


LTFYZ 
LG SO G 
K 


MESSAGE 2 


CW HP K 
KXFLU 
MKURY 
X C 0 PH 
WNJUW 
KW I H L 


0 K Z TL 
AWRDF 
GD DEZ 
D L B 0 T 
FU ZN A 
SRHHJ 
NGUZK 
PRC DK 
Y 0 0 B V 
DD X CD 
0 G R G I 
RM IC N 


HS G GO 
PYAOY x 


MESSAGE 3 


W F WT D 
NHTGM 
RA AZ G 
P JDS Q 
AU PF R 
0 X J R 0 
HRZWC 
ZS RTE 
EEVPX 
0 A T D Q 
L D 0 Q Z 
HAWNX 
THDXL 
HY I GK 
VYZWX 
B K 0 Q 0 
AZ Q ND 
TN ALT 
CNYEH 
TS CT 


MESSAGE4 


TULDH 
N Q E Z Z 
UT Y GD 
U EDU P 
S D L I 0 
L N NB 0 


NY L Q Q 
V Q G CD 
UT U B Q 
XS 0 SK 
N 0 XU V 
KCYJX 


C NJ KS 
ANG U I 
F T 0 W 0 
MS NB Q 
DB A IV 
I KN W G 


VS HIE 
p 


b SuperimpoBlng 8 messages 1 and 2, begmnmg with their 1st letters, 


a 
10 
15 
20 
25 
30 
aa 


No L----- P G L f N H U [ R K S A y Q Q A Q Y U O Z A K G A E 0 Q C N P R K 0 V 
No 2_______ C W H f K K X [ L U M K !l R Y X C 0 P H W N J U W K W I H L 0 K Z T L 


~ 
" 
W 
M 
00 
~ 
ro 


No L ----- H Y E I U Y N B 0 N N F D M W Z L U K Q A Q A li Z M g C D S L E A G C 
No 2 _______ AW RD F GD DEZ D LB 0 T FU ZN AS R H li J N g U Z K P R C D K 


711 
80 
86 
llO 
96 
100 


No L______ J P I V J W V A U !2 B A H M I H K 0 R M L T F Y Z L G S Q G K 
No 2 _______ Y 0 0 B VD DX C !2 0 GR G .! RM I C NH S G G 0 P Y A Q Y X 


the number of comc1dences is found to be 8 
Smee the total number of comparisons lS 101, the 
expected number, if the superimposition were correct, should be lOlX 0667=6 7367, or about 
7 comcidences 
The fact that the observed number of comr1dences matches and lS even greater 


than the expected number on the very first tnal creates an element of susp1c1on such good 
fortune 18 rarely the lot of the practical cryptanalyst 
It is very unwise to stop at the first tnal, 
even 'if the reB'Ults are favorab'le, for this close agreement between theoretical and actual numbers 


• The student will have to unagme the messages written out as continuous sequences on cross-section paper 
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of coincidences uught Just be "one of those accidents " Therefore message 2 18 shifted one 
space to the nght, placmg its 1st letter beneath the 2d letter of message 1 
.Again the number 
of coincidences 18 noted and this time it 18 found to be only 4 
The total number of compansons 


18 now 100, the expected number 18 still about 7 
Here the observed number of comcidences 18 
conSlderably less than the expected number, and when the relatively small number of com- 
par!Sons 18 borne in mmd, the discrepancy between the theoretical and actual results 18 all the 
more stnkmg 
The hasty cryptanalyst might therefore Ju.mp to the conclusion that the 1st 


supenmposition 18 actually the correct one 
But only two tnals have been made thus far and 


a few more are still adVlSable, for in this scheme of supenmposmg a senes of messages it is 
absolutely essential that the very first superrmpoSltions rest upon a perfectly sound foundation- 
othel'WlSe subsequent work wtll be very dllhcult, if not entirely fruitless 
Additional tnals will 


therefore be made 


c Message 2 18 shifted one more space to the nght and the number of coincidences 1s now 
found to be only 3 
Once agam message 2 is shifted, to the poSltion shown below, and the 
observed number of comcidences JUmps suddenly to 9 


s 
10 
15 
20 
2s 
ao 
as 


No L______ P G L P N H U F R K S A Y Q Q A Q ! U 0 Z A K G A E 0 Q C N P R K Q V 
No 2_______ 
C W H P K K X F L y M K U R ! X C 0 P H W N J U W K W I H L Q K 


40 
45 
so 
06 
80 
115 
70 


No L _____ HYE I UY NB 0 N NF D MW Z LUK QA Q A H Z M G C D S L E A G C 
No 2_______ Z T L A W R D F G D D E Z D L B 0 T F U Z N A S R H H J N G U Z K P R 


75 
80 
8li 
90 
9S 
100 


No L______ J P I V J W V A U 12 B A H M I H K 0 B M L T F Y Z L g S 0 G K 
No 2_______ C D K Y 0 0 B V D 12 X C D 0 G R G I B M I C N H S G g 0 P Y A 0 Y X 


The total number of companbons is now 98, so that the expected number of coincidences 18 98X 
0667=6 5366, or still about 7 
The 2d and 3d super1mp0Sltions are defimtely mcorrect, as to 
the 1st and 4th, the latter gives almost 30 perc,ent more comcidences than the former Agam 
collSldenng the relatively small number of compansons, this 30 percent difference in favor of 
the 4th supenmpoSltion as against the 1st lS important 
Further detailed explanation 18 unneces- 


sary, and the student may now be told that it happen& that the 4th supenmpoSltion is really 
correct, if the messages were longer, all doubt would be dlSpelled 
The relatively large number 
of comcidences found at the 1st supenmposition is purely accidental m thlB case 
d The phenomenon noted above, wherem the observed number of comcidences shows a 


sudden increase m movmg from an mcorrect to a correct supenmposition is not at all unusual, 
nor should it be unexpected, because there is only one correct supenmposition, whtle all other 
supenmpoBltions are entirely mcorrect 
In other words, a supenmposition 18 either 100 percent 
correct or 100 percent wrong-and there are no gradations between these two extremes 
Theoretically, therefore, the difference between the correct supenmpoSition and any one of the 
many mcorrect supenmpoSltions should be very marked, smce it follows from what has been 
noted above, that one cannot expect that the discrepancy between the actual and the theoretical 
number of comc1dences should get smaller and smaller as one approache<J closer and closer to 
the correct supenmpos1tion 7 For if letters belongmg to the same cipher alphabet are regarded 


7 The 1.Dlportance of this remark will be appreciated when the student comes to study longer examples, m 


which stat1st1cal expectations have a better opportunity to matenahve 
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as bemg members of the same fauuly, so to speak, then the two letters formmg the successive 
pairs of letters brought mto supenmposition by an mcorrect placement of one message relative 
to another are total strangers to earh other, brought together by pure chance 
This happens 


time and agam, as one me<Jsage is shd agamst the other-until the correct supenmpoSit1on is 
reached whereupon m eiery rase the two supenmposed letters belong to the same family 
There 
may be' many different fauuhes (cipher alphabets) but the fact that m every case two members 
of the same fauuly are present causes the marked Jump m number of comc1dences 
e In shifting one message agamst another, the cryptanalyst may move to the nght con- 
stantly, or he may move to the left constantly, or he may move alternately to the left and nght 
from a selected m1t1al pomt 
Perhaps the latter is the best plan 
J (1) Havmg properly supenmposed messages 1 and 2, message 3 is next to be studied 


Now it is of course posSible to test the lattei message agamst the combmat1on of the former, 
without further ado 
That is, ascertammg merely the total number of comr1dences given by the 


supenmpoSit1on of the 3 messages rmght be thought sufficient 
But for reasons which wtll 
soon become apparent it is better, even though much more work is mvolved, first to test message 
3 agamst message 1 alone and agamst message 2 alone 
This will really not mvolve much add1- 


ttonal work after all, Slnce the two tests can be conducted SlIDultaneously, because the proper 
supenmpositton of messages 1 and 2 is already known If the tests against messages 1 and 2 
separately at a given supenmpositton give good results, then message 3 can be tested, at that 
supenmpos1t1on, agamst me~sages 1 and 2 combmed 
That is, all 3 messages are tested as a 
smgle set 
Smee, according to the scheme outlmed, a set of three closely related tests is mvolved, 
one uught as well systematize the work so as to save trme and effort, if possible 
With this m 
view a diagram such as that shown m Figure 1 la is made and m it the w.nc,idences are recorded 
m the appropnate cells, to show separately the com(,ldences between mesc;ages 1 and 2, 1 and 3, 
2 and 3 for each supenmpoSitton tested 
The number of tallies m the cell 1-2 18 the same at 
the begi~g of all the tests, it has already been found to be 9 
Therefore, 9 tallies are inserted 
m cell 1-2 to begm with 
A column which shows identical letters m messages 1 and 3 yields a 
"lmgle tally for cell 1-3, a column wluch shows 1dent1ro.l letters m messages 2 and 3 yields a smgle 
tally for cell 2-3 
Only when a supenmpos1tton yields 3 1denttral letters ma column, 18 a tally 


to be recorded Simultaneously m cellc; 1-3 and 2-3, smce the presence of 3 identical letters m the 
column yields 3 comcidences 


1 


2 


3 


1 
2 
3 


x 
/'Ill 
Ill 
Ill/ 
-- - 
- 
x 
x 
Ill 


- 
----- 
x 
x 
x 


FIGUBB lla 


66 


(2) Let message 3 be placed beneath messages 1 and 2 oombmed, so that the let letter of 


medthsagtet3h falls under the let letter of message 1 
(It IS advisable to fasten the latter m place 
so 
a 
ey cannot easily be disturbed ) Thus 


1 
2 
3 
4 
6 
6 
7 
8 
g 10 11 12 13 1' 15 16 17 18 19 20 21 
2l1 23 24 25 26 27 
L--------- P G L P N H U F R K S A Y Q Q A Q Y U 0 Z A K G A E O 
2----------- 
C W H P K K X F L Y M K U R X X C 0 P H W N J U 


3----------- W F W T D N H T G M R A A Z G P J D S Q A U p F R O X 


M~-~~~MHU~~~~~na"""a~~m~~ 


L_________ Q C N P R K Q V H Y E I U Y N B 0 N N F D M W z L ~ ; 
2___________ W K W I H L Q K ~ T L A W R D F G D D E Z D L V O T F 
3----------- J R 0 H R Z W C ~ S R T E E E V P X O A T ~ Q L D o Q 


UHmM~•M~M"PM~~Mron~nuu~w~NMM 


~---------- Q A Q A H Z M G C D S L E A G C J p I V J W V A U D B 
----------- u z N A s R H !:! J N G u z K p R c D K y 0 0 B v D D x 
3___________ Z H A W N X T H D X L H Y I G K V Y Z W X B K O Q o A 


1 
~UMUM~-~~m~nMN~~~~~m~~™ 


----------- A H M I H K 0 .B M L T F Y Z L G S O G K 
2___________ C D 0 G R G I .B M I C N H S G G O p y A O y X 
3___________ Z Q N D T N A L T C N Y E H T S C T 


1 


2 


3 


l 
2 
3 


I 
,'IJJ I 
I 
x 
/Ill 
Ill 
f--- - 
- 
x 
x 
/fl 


x 
x 
x 


FIGUll.B 116 


The succeBSlve columns are now e 
d 
d h 
only oomc1dences b t 
xamme an t e comcidences are recorded, remembenng that 
lated m the d1a 
e we~hmessages 1 and 3, and between messages 2 and 3 are now to be tabu- 


poSltion yields fu~~ <'om:i::~~~:s :::w~~: !~t test are shown m Figure llb 
Tlus supenm- 


messages 2 and 3 
Th t t I 
b 
ssages 1 and 3, and the same number between 
ls drawn up 
e o a num ers of compansons are then noted and the following table 


f'ombmat1on 
'l'ntal numb•r 
Number or comr1d•nreq 


or tompar1•on• --- 
D1oerep 


ExprCIPd 
Oh~•rv!'d 
anry 


-- 


Mess&ges I and 1 
9q 
About 


Percent 


Messages 2 and 3 
- 
- 
7 
3 
-57 


Messages 1, 2, anrl 3 
- 
96 
About 6 
3 
-50 


291 
About 19 
15 
-21 
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(3) The reason for the separate tabulation of commdences between messages 1 and 3, 
2 and 3, and 1, 2, and 3 should now be apparent 
Whereas the observed number of comc1dences 
ls 57 percent below the expected number of comcidences m the case of messages 1 and 3 alone, 
and 50 percent below in the case of messages 2 and 3 alone, the discrepancy between the expected 
and observed numbers ls not qmte so marked (-21 percent) when all three messages are con- 
sidered together, because the relatively high number of comcidences between messages 1 and 2, 
winch are correctly supenmposed, serves to counterbalance the low numbers o.f comc1dences 
between 1and3, and 2 and 3 
Th1L8, a correct superimposdwnfor one of the three combinatwns 
may yield 8'UCh good results as to mask the bad re8Ults for the other two combinatwns 


(4) Message 3 18 then slufted one space to the right, and these.me procedure is followed as 
before 
The results are shown below 


II 
10 
l& 
20 
25 
30 
35 


No L----- P G L P N H U F R K S A y Q Q A Q ! U O Z A K G A E Q Q C N P R K Q V 
No 2------- 
C W Jj P K K X F L y M K U R ! X C O P H W N J U W K W I H L Q. K 
No 3------- 
W F WT D NH T GM RA AZ GP J D S Q A U P F R Q. X J R 0 !:! R Z W 


40 
46 
M 
M 
00 
6ll 
70 


No L----- H Y E I U Y N B O N N F D M W Z b U K g A Q ! H Z M G C Q S I:! E A G C 
No 2------- Z T L A W R D F G D D E Z D L B 0 T F U Z N ! S R H H J N G U Z K P R 
No 3------- C Z S R T E E E V P X 0 A T D Q b D O Q. Z H A W N X T H Q X b H Y I G 


111 
m 
s& 
oo 
05 
101 


No i_______ J P I V J W V A U Q B A H M I H K 0 .B M L T F X Z L g S 0 G K 
No 2_______ C D K Y 0 O ~ V D Q X C D 0 G R G I .B M I Q N H S G Q 0 P Y A 0 Y X 
No 3. ----- K V Y Z W X ~ K 0 Q 0 ! Z Q N D T N A L T Q li X E H T S C T 


1 
2 
3 


1 
x 
'1111 
~ 


Total mun 
Number of como1denoes 


Combmatwn 
berof 
Discrep 


complll'ISODB 
Expected 
ObserVBd 
anay 


2 
x 
x 
"f 


3 
x 
x 
x 


PmdflC 
Messages 1 and 3 ___ ------ 
99 
About 7 
10 
+43 


Messages 2 and 3 _ -·----- 
97 
About 6 
6 
0 
Messages 1, 2, and 3 _ __ 
293 
About 20 
25 
+25 


Jl'IG'IJBB llc 
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Note how well the observed and expected numbers of comcidences agree m all three combma- 
tlons 
Indeed, the results of tins test are so good that the cryptanalyst might well hesitate to 
make any more tests 
(5) Having ascertamed the relative poBltlons of 3 messages, the fourth message is now 


studied 
Here are the results tor the correct supenmpoBltlon 


Ii 
10 
15 
20 
25 
30 
3~ 
No L ____ _ 
No 2 ______ _ 
No 3 ______ _ 
No 4 ______ _ 


PGLPNHUFRKSAYQQAQXUOZAKGAEOQCNPRKOV 
CWHPKKXFLYMKURXXCO~HWNJUWKWIHLOK 
WFWTQNHTGMRAAZQPJDSQAUPFROXJROHRZW 
TULQHNQEZZYTYGDUEDUPSDLIOLNNBONYL 
- 
- 
- 
- 


to 
411 
'ill 
M 
M 
611 
70 


No L_____ H Y E I U Y N B 0 N N F D M W Z .b U K g A Q A H Z M G C D S L E A G C 
No 2 _______ Z T L A W R Q F G D D E Z D L B 0 T F U Z N A S R H H J N G U z K p R 
N 0 3_______ c z s R T E E E v p x 0 A T D Q .b D Q g ~ H A w N x T H D x L H y I G 
N 0 4_______ Q Q v Q G c Q u T u B Q x s 0 s K N Q x u v K c y J x Q H J K s ! N g 


75 
80 
85 
90 
911 
101 


No L_____ J P I V J ! V A U Q !! ! H M I H K 0 R M L T F Y Z L G S 0 G K 
N 0 2_______ c D K y Q 0 !! v D Q x c Q 0 G R G ! R M I Q N H s G g 0 p y A 0 y x 
No 3_______ K V Y Z W X !! K 0 Q 0 ! Z Q N D T N A L T C N Y E H T S C T 
No 4 ------ U I F T Q ! 0 MS N !! Q QB A I V ! KN W G V S H I E p 


1 


2 


3 


4 


1 
2 
3 4 


x w '!Iii 'ff 
.....__ - ---- 
x 
x 
!HI 
fl./J 
I 
I 
I 
.....__ -- - 
-- 
x 
x 
x 
!HI 
~ 
- 
- 
- 
x 
x 
x 
x 


FIGVBB lld 


Total num 
Number of co1nc1dences 


C ombmat10n 
b~r of 
D"crPp 
comparu.on• 
Expected 
Observed 


anLy 


Perce11t 


Messages 1 and 4 
96 
About 6 
7 
+16 
Messages 2 and 4 _ --- 
95 
About 6 
7 
+16 
Messages 3 and 4 
----- 
96 
About 6 
5 
-16 


Messages 1, 2, 3, and 4 ___ 
581 
About 39 
43 
+10 


The results for an mcorrect supenmpos1t1on (1st letter of message 4 under 4th letter of message 1) 
are also sho'\\n for companson 
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II 
10 
n 
20 
25 
30 
,, 


No L_____ P G L P N H U F R K S A U Q Q A Q Y y 0 Z A K G A E 0 Q C N P R K 0 V 
No 2_______ 
C W H P K K X F L U M K U R Y X C 0 P H W N J U W K W I H L 0 K 
No 3_______ 
W F W T D N H T G M R A A Z G P J D S Q A U P F R 0 X J R 0 H R Z W 
No 4_______ 
TU L DH N Q E Z Z UT Y GD U ED U P S D L I 0 L N N B 0 N Y 
- 
- 
- 


to 
411 
00 
5~ 
60 
66 
70 


No L______ H Y E I U Y N B 0 N N F D M W Z L U K Q A Q A H Z M G C D S L E A G C 
No 2_______ Z T L A W R D F G D D E Z D L B 0 T F U Z N A S R H H J N G U Z K P R 
No 3_______ C Z S R T E E E V P X 0 A T D Q L D 0 Q Z H A W N X T H D X L H Y I G 
No 4 _______ L Q Q V Q G CD UT U B Q XS 0 SK N 0 X U V K C Y J X C N J K S A N 


75 
80 
85 
90 
95 
101 


No L_ _____ J P ! VJ WV AUD BAHM I HK 0 RM L T F Y Z L G S 0 G K 
No 2_ ----- CD KY 0 0 B VD DX CD 0 GR GI RM I C N H S G G 0 P Y A 0 Y X 
No 3_______ K V Y Z W X B K O Q O A Z Q N D T N A L T C N Y E H T S C T 
No 4 ______ GU IF T 0 W 0 MS NB Q DB A IV I KN W G V S H I E P 
- 
- 
- 
- 


1 


2 


3 


4 


1 
2 
3 
4 


x w '!Iii 
Ill 
-- - 
- 
- 
x 
x l1f 
'II 
,___ - 
- 
- 
x 
x 
x 
I 


,___ - 
- 
- 
x x x x 


Fmvu: 11• 


Total num 
Number or comc1dences 
Combmat1on 
hArof 


compert">On• 
E:rpected 
Observed 


Messages 1 and 4 __ ------- 
96 
About 6 
3 


Messa.gee 2 and 4 __ ------- 
96 
About 6 
3 
Messages 3 and 4 __ -....... 
96 
About 6 
1 


Messages 1, 2, 3 and 4 - 
582 
About 39 
33 


f\ •t'l'ep 
ft TI("'\- 


Ptru11t 
-50 
-50 
-83 
-18 


(6) It lB behaved that the procedure has been explamed with sufficient dete.tl to make further 
examples unnecessary 
The student should bear m mmd always that as he adds messages to 
the supenmp0S1tlon diagram it lB necessary that he recalculate the number of comparuons so 
that the conect expected or theoretical number of comcidences will be before hun to compare 
with the observed number 
In addmg messages he should see that the results of the separate 
tests are conBlBtent, as well as those for the combmed tests, oth01'W1Se he may be led astray at 
times by the overbalancmg effect of the large number of comcidences for the already ascertamed, 
conect supenmpoSltions 
44 Subsequent steps -a Jn paragraph 43a four messages were given of a senes supposedly 


enciphered by a long keymg sequence, and the succeeding paragraphs were devoted to an ex- 
planation of the preparatory steps m the solution 
The messages have now been properly 


supenmposed, so that the text has been reduced to monoalphabetlc columnar form, and the 
matter lB now to be pursued to its ultunate stages 
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b The four messages employed m the demonstration of the pnnciples of the 1C test have 
served thell' purpose 
The mformation that they are messages enciphered by an intelligible 


runmng key, by reversed standard cipher alphabets, was withheld from the student, for peda- 
gogical reasons 
Were the key a random sequence of letters instead of mtelhgible text, the 


explanation of the comcidence test would have been unchanged m the slightest particular, so 
far as concerns the mechamcs of the text itself 
Were the Cipher alphabets unknown, mixed 


alphabets, the explanation of the IC test would also have been unchanged m the slightest par- 
ticular 
But, as stated before, the four messages actually represent encipherments by means of 


an mtelhgible runmng key, by reversed standard alphabets, they will now be used to illustrate 
the solution of cases of this sort 
c Assummg now that the cryptanalyst 18 fully aware that the enemy 18 usmg the runmng- 
key system with reversed standard alphabets (obsolete U S Army Cipher disk), the method of 
solution outlined m paragraph 38 will be illustrated, employing the :first of the four messages 
referred to above, that beginmng PGLPN HUFRK SAUQQ 
The word DIVISION will be taken as 
a probable word and tested against the key, beg:i.nmng with the very :first letter of the message 
Thus 


Cipher text------------------------- P G L P N H U F R K S A U Q Q 
Assumed plam text______________ D I V I S I 0 N 
Resultant key text_______________ S 0 G X F 


The resultant key text is umntelhgible and the word DIVISION 18 shifted one letter to the nght 


Cipher text_________________________ P G L P N H U F R K S A U Q Q 
Assumed plain text______________ 
D I V I S I 0 N 
Resultant key text -------------- 
J T K 


Agam the resultant key text is umntelhgible and the hypothetical word DIVISION 18 shifted 
once more 
Continuation of this process to the end of the message proves that the word 18 not 
present 
Another probable word 18 assumed 
REGIMENT 
When the point shown below is 
reached, note the results 


Cipher text------------------------- P G L P N H U F R K S A U Q Q 
Assumed plam text______________ 
• R E G I M E N T 
Resultant key text_______________ • 
E L A N D 0 F T 
It certamly looks as though mtelhgible text were bemg obtained as key text 
The words 
LAND OF T 
suggest that THE be tned 
The key letters HE give NO, making the plam text 
read 
REGIMENT NO 
The four spaces preceding REGIMENT suggest such words 


as HAVE, SEND, MOVE, THIS, etc 
A clue may be found by assuming that the E before LAND 


in the key is part of the word THE 
Testing it on the Cipher text gives IS for the plam text, 


which certamly indicates that the message begins with the word THIS 
The latter yields IN 
for the :first two key letters 
And so on, the process of checking one text against the other con- 


tinuing unttl the entire message and the key text have been reconstructed 
d Thus far the demonstration has employed but one of the four messages available for 


solution 
When the reconstn1ction process is applied to all four simultaneously it naturally 
goes much faster, with reduced necesSity for assummg words after an mitial entenng wedge has 
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been dnven into one message For example, note what happens m this case JUSt ac:; soon as the 
word REGIMENT is tned m the proper place 


Key text _____ ----------------1 
I I EIL AIN D OIF Tl 
I 


No 1 {Cipher text __________________ PG L p NH U F R K S A u Q Q 


Plain text ____________________ 
R E G I M EN T 


No 2 {Cipher text __________________ 
c W H p K K X FL UM K 
Plain text ____________________ 
I EL D T RA I 


No 3 


{Cipher text __________________ 
w F W TD NH T G M R A A z 
Plam text ____________________ 
L I NG K I T c 


No 4 {Cipher text __________________ 
T u L D H N Q E z z u T y 


Plain text ____________________ 
T I TA NK GU 


It is obvious that No 2 begins with FIELD TRAIN, No 3, with ROLLING KITCHEN, No 4 
with ANTITANK GUN 
These words yield additional key letters, the latter suggest additional 
plam text, and thus the process goes on unttl the solution 1s completed 


e But now suppose that the key text that has been actually employed in enc1pherment is 


not mtelbg:tble text The process 18 sWI somewhat the same, only m thlB case one must have at 
least two messages m the same key 
For instead of checking a hypothetical word (assumed to 
be present m one message) agamst the key, the same kind of a check is made against the other 
message or messages 
Assume, for mstance, that in the case JUst descnbed the key text, mstead 
of bemg mtelhgible text, were a senes of letters produced by applying a rather complex transpo- 
Sition to an onginally intelhgible key text 
Then if the word REGIMENT were assumed to be 
present m the proper place m message No 1 the resultant key letters would yield an umntelhgible 
sequence 
But these key letters when apphed to message No 2 would nevertheless yield 


IELDTRAI, when apphed to message No 3, LINGKITC, and so on 
In short, the text of one mes- 


sage is checked against the te~ of another message or messages, if the ongmally assumed word 18 
correct, then plam text will be found m the other messages 8 


• Perhaps this 18 as good a place as any to make some observations wluch are of general interest m connection 
with the running-key pr1Dciple, and which have no doubt been the subJect of speculation on the part of some 
students 
Suppose a basic, unmtelhgible, random sequence of keying characters which 18 not derived from the 


1Dteraetion of two or more shorter keys and which ne11er repeat& 18 employed but once as a key for enciphei ment 
Can a cryptogram enciphered in such a system be solved? The answer to this question must unquahfiedly be 
this even if the cipher alphabets are known sequences, cryptanalytic smence is certamly powerles'I to attack 
such a cryptogram 
Furthermore, so far as can now be di'lcerned, no method of attack 1s hkely ever to be devi'lerl 


Short of methods based upon the alleged phenomena of telepathy-the very obJect1ve exlStence of which i'I 
dented by most "sane" mvest1gators today-it 18 impossible for the present author to conceive of any way of 
attackmg such a cryptogram 


This is a ease (and perhaps the onl~ ease) ID which the 1mpoCJs1b1hty of cryptanalysis 1s mathematirallv 


demonstrable 
Two thmgs are mvolved m a complete solution m mathematics not only must a satJSfactory 


(log1eal) answer to the problem be offered, but also 1t must be demonstrated that the answer offered 1s uniqW', 
that ts, the only posSJble one 
(The mlStake 18 often made that the latter phase of what constitutes a vahrl 
11olut1on 1s overlooked-and tlus 1s the basic error whrnh numerous alleged Bacon-Shakespeare "cryptographers" 
comIDJ* ) 
To attempt to solve a cryptogram enmphered m the manner md!cated is analogous to an attempt to 
find a unique solution for a smgle equation eonta.in1Dg two unknowns, with absolutely no data available for 
solution other than those given by that equation itself 
It is obvious that no umque solution is possible ID such 
a case, smee any one quantity whatsoeuer may be chosen for one of the unknowns and the other will follow as a 
3onseouenoe 
Therefore an mfimte number of different answers, all equally vahd, 18 poSSlble 
In the ease of a 
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f All the foregomg work is, of course, based upon a. Imowledge of the cipher alphabets 
employed m the enc1pherment 
What if the latter a.re unlmown sequences? It may be stated 


at once that not much could be done with but four messages, even after they had been super- 
imposed correctly, for the most that one would have m the way of data for the solution of the 
md1V1dual columns of text would be four letters per alphabet--which is not nearly enough 
Data for solution by mdirect symmetry by the detection of isomorphs cannot be expected, for 
no isomorphs a.re produced m this system 
Solution can be reached only if there is sufficient 


text to permit of the analysis of the columns of the superimposition diagram 
When there is 
this amount of text there are also repetitions which afford bases for the assumption of probable 
words 
Only then, and after the values of a few cipher letters have been established can mdirect 
<iymmetry be applied to facilitate the reconstruction of the primary components-if used 
g Even when the volume of text is great enough so that each column contams say 15 to 20 


letters, the problem is still not an easy one 
But frequency distnbut1ons with 15 to 20 letter<i 
can usually be studied stat1shcally, so that if two distributions present Slliltlar cha.ractenst1c'3, 
the latter may be used a<i a baSis for comb1mng d1stnbutions which pertam to the same cipher 
alphabet 
The next section will be devoted to a detailed treatment of the imphcations of the 
last statement 


cryptogram enciphered ID the manner 1Dd1cated, there 1a the equivalent of an equation with two unknown'!, 
the key lB one of the unknowns, the plain text IB the other 
One may COD]ure up an mfimte number of different 


p1am texts and offer any one of them as a "solutmn " 
One may even perform the perfectly meanmgleaa labor 
of reconatructmg the "key" for this selected "solution", but 11nce there IB no way of provlllg from the cryptogram 
itself, or from the reconstructed key (which is un1Dtelhgib1e) whether the "solution" so selected JB thB actual 
plalll text, all of the infinite number of "solutions" are equally valid 
Now smce 1t 1B inherent m the very idea 


of cryptography as a practical art that there must and can be only one actual solution (or plain text), and smce 
none of th1s mfimte number of ddfe1ent aolut1ons can be proved to be the one and only correct solution, therefo1e, 
our common sense reJects them one and all, and it may be said that a cryptogram enciphered m the manner 
mcbcated IB absolutely impo8Blble to solve 
It is perhaps unneceaaary to pomt out that the foregomg statement is no longer true when the runrung key 
constitutes mtelbg1ule text, or if it 1s used to encipher more than one message, or If it is the secondary resultant of 
the interaction of tv.o or mc,re '!hort primary keys which go through cycles themselves 
Form these co.sea there 


1s additional mformat1on available for the dellm1tation of one of the pair of unknowns, and hence a unique solu- 
tion becomes possible 


Now although the runwng-key system described m the first paragiaph represents the ultimate goal of 
cryptographic security and is the 1de'IJ. toward wluch cryptographic experts have atnven for a long time, there is 
a wide abyss to be bridged between the reoogrut1on of a theoretically perfect system and its estabhahment as a 
practical means of secret 1nteroommumoation 
For the mere mechanical details involved m the production, 


reproduction, and distr1but1on of such keys present difficulties which are so formidable as to destroy the effect1ve- 
neaa of the method as a system of secret mtercommuruoat1on suitable for groups of correspondents engaged m a 
voluminous exchange of messages 


SECTION XII 


THE "CROSS-PRODUCT SUM" OR "x TEST" 1 


Paragraph 
Prehmmary remarks ---------------------- ------ 
------------------------------------ ----------- ------------------------ ------ 
45 
The nature of the "Croaa-product sum" or "x (Cln) test" m cryptano.lyslB--- -- ---------------------- - --------- 
46 


Denvation of the x teat 
_ __ 
--------- _ _ ---------------------------------- ------- -- ----------- ---------------------- 
47 


Applying the x teat ID matching d1str1butiona •• ----------------- -------------------- ----------- ------------------------ 
48 


45. Prehmmary remarks.-a The real purpose of makmg the como1dence test m cases such 
as that studied m the precedmg section 18 to pel'Jlllt the cryptanalyst to arrange hIS data so as to 
Cll'Cumvent the obstacle which the enemy, by adopting a comphcated polyalphabetic scheme of 
encJpherment, places m the way of solution 
The essence of the matter is that by dealmg mdi- 


Vldually with the respective columns of the supenmpomtion diagram the cryptanalyst has 
arranged the polyalphabetic text so that it can be handled as though it were monoalphabetic 
Usually, the solution of the latter 18 a. relatively easy matter, especially if there 18 sufficient text 
m the columns, or if the letters within certam columns can be combmed mto smgle frequency 
dIStnbutions, or if some cryptographic relationship can be estabhshed between the columns 


b It 18 obvious that merely ascertammg the correct relative pomtions of the separate mes- 


sages of a senee of messages m a superimposition diagram IS only a means to an end, and not an 
end m 1tseH 
The purpose is, as already stated, to reduce the complex, heterogeneous, poly- 


alphabetic text to SlDlple, homogeneous, monoalphabetic text 
But the latter can be solved only 
when there a.re sufficient data for the purpose-and that depends often upon the type of cipher 
alphabets mvolved 
The latter may be the secondary alphabets resulting from the shding of the 


normal sequence against its reverse, or a mixed component against the normal, and so on 
The 
student has enough information concerning the vanous cryptanalytic procedures which may be 
apphed, depending upon the circumstances, m reconstructing different types of pnm.ary com- 
ponents and no more need be said on this score at this pomt 
c The student should, however, reahze one pomt which has thus far not been brought 


specifically to hIS attention 
Although the supenmpos1tion diagram refeITed to m the precedmg 
subparagraph may be composed of many columns, there is often only a relatively small number 
of d'dferenl cipher alphabets mvolved 
For example, m the case of two pnroary components of 
26 letters each there 18 a maximum of 26 secondary 01pher alphabets 
Consequently, it follows 
that m such a case if a supenropomtion diagram IS composed of say 100 columns, certam of those 
columns must represent Slmtla.r secondary alphabets 
There may, and probably will be, no 


regulanty of recurrence of these repeated secondanee, for they a.re used m a manner directly 
governed by the letters compoSlDg the words of the key text or the elements compoSlDg the 
keymg sequence 
d But the latter statement offers an excellent clue It IS clear that the number of times a 
given secondary alphabet IS employed m such a supenropoSition diagram depends upon the com- 


1 The x test, presented in this section, as well as the ii> test, presented lil Section XIV, were first described 
lil an unportant paper, Statiatlcal Methodat.n Cryptanalyaia, 193li, by Solomon Kullback, Ph D , Associate Crypt- 
analyst, Signal Intelligence Serv1ce 
I take pleasure lil acknowledgmg my indebtedness to Dr Kullback'a 
paper for the baalc material used m my own expo8lt1on of these teats, as well as for hJs helpful cnt1cl8DJ8 thereof 
wlule m manusaript 
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position of the key text 
Smee m the case of a runnmg-key system uSlllg a book as a key the 
key text constitutes mtelhgible text, it follows that the various secondary alphabets will be em- 
ployed with frequencies which are directly related to the respective frequencies of occurrence of letters 
in normal plain te:st 
Thus, the alphabet correspondmg to key letter E should be the most 
frequently used, the alphabet correspondmg to key letter T should be next m frequency, and so on 
From this it follows that mstead of bemg confronted with a problem mvolving as many dllf erent 
secondary cipher alphabets as there are columns m the supenmposition diagram, the crypt- 
analyst will usually have not over 26 such alphabets to deal with, and allowmg for the extremely 
improbable repetitive use of alphabets correspondmg to key letters J, K, Q, X, and Z, it is hkely 
that the cryptanalyst will have to handle only about 19 or 20 secondary alphabets 


e Moreover, Slllce the E secondary alphabet will be used most frequently and so on, it is 


posSlble for the cryptanalyst to study the vanous dIStnbutions for the columns of the super- 
lDlpoSltion diagram with a view to assemblmg those distnbutions which belong to the same cipher 
alphabet, thus makmg the actual determmation of values much e&.SJer m the combmed distn- 
butions than would otheI'WJ.se be the case 


f However, 1f the keymg sequence does not itself constitute mtelhgible text, even 1f 1t IS 
a random sequence, the case IS by no means hopeless of solution-provided there IS sufficient 
text withm columns so that the columnar frequency dIStnbut1ons may afford mdicat1ons enabling 
the cryptanalyst to amalgamate a large number of small dIStnbutions mto a smaller number of 
larger dIStnbutions 


g In this process of assemblmg or combrmng mdiv1dual frequency dIStnbutions which be- 
long to the same Cipher alphabet, recourse may be had to a procedure merely alluded to m con- 
nection with previous problems, and demgnated as that of "matching" dIStnbutions 
The next 
few paragraphs will deal with this lJllportant subJect 
46 The nature of the 11Cross-product sum" or "x (Chi) test" m cryptanalysis -a The 
student has already been confronted with cases m which it was necessary or demable to reduce 
a large number of frequency dIStnbutions to a smaller number by identllymg and amalgamating 
dlStnbutions which belong to the same Cipher alphabet 
Thus, for example, m a case m which 


there are, say, 15 dlStnbutions but only, say, 5 separate cipher alpha.bets, the difficulty m solving 
a message can be reduced to a collSlderable degree provided that of the 15 distnbutions those 
which belong together can be 1dentrlied and allocated to the respective cipher alphabets to which 
they apply 
b ThIS process of 1dentifymg dlStnbutions which belong to the same cipher alphabet m- 
volves a careful exammation and companson of the vanous members of the entire set of d1stn- 
butions to ascertam which of them present sufficiently sumlar che.racterutics to warrant their 
bemg combmed mto a smgle dlstnbution apphcable to one of the cipher alpha.bets mvolved m 
the problem 
Now when the mdividue.l dIStnbutions are fairly large, say contammg over 50 


or 60 letters, the matter IS relatively easy for the expenenced cryptanalyst and can be made by 
the eye, but when the dlStnbutions are small, each cont&llllllg a rather small number of letters, 
ocular comparuon and 1dentrlication of two or more distnbutions as belongmg to the same alpha- 
bet become qmte chfficult and often mconcluSlve 
In any event, the time reqmred for the suc- 
cessful reduction of a multiphClty of mdividual small dlStnbutions to a few larger distnbutions 
is, m such cases, a very matenal factor m determmmg whether the solution will be accomplIShed 
m tune to be of actual value or merely of hIStoncal mterest 


c However, a certam statistical test, called the "cross-product sum" or "x test", has been 


devised, wluch can be brought to bear upon thIS question and, by methods of mathematical 
companson, ehmmate to a large degree the uncertamties of the ocular method of matching and 
combrmng frequency distnbutions, thus m many cases matenally reducmg the time reqwred 
for solution of a. complex problem 
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d It is adVlSable to pomt out, however, that the student must not expect too much of a 
mathematical method of companng distnbutions, because there are lmuts to the SlZe of distribu- 
tions to be matched below which these methods will not be effective 
If t\\o distnbutions 
contain some simtlar charactenstics the mathematical method will merely afford a quantitative 
measure of the degree of simtlanty 
Two distnbutions may actually pertam to the same cipher 


alphabet but, as occaSlonally happens, they may not present any external evidences of this 
relationship, m which case no mathematical method can mdicate the fact that the two distnbu- 
tions are really smular and belong to the 13ame alphabet 
47. Derivation of the x test-a ConSlder the followmg plam-text dIStnbut10n of 50 letters 


~ 
- 
- 
~ 
~'~~ 
~~ 
~~~~ 
~~~~ 
~ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 


In a previous text 2 1t was shown that the chance of drawing two identical letters m normal 
Enghsh telegraphic plam text IS the sum of the squares of the relative probabilities of occurrence 
of the 26 letters m such text, which is 0667 
That IS, the probability of monographic comcidence 
m Enghsh telegraphic plem text IS Kp= 0667 
In the message to which the foregomg d1stnbu- 


tion of 50 letters apphes, the number of posSlble pairlllgS (compansons) that can be made between 


50X49 
Blngle letters is 
2 
===1,225 
Accordmg to the theory of comc1dences there should, therefore 
be 1,225X 0667=81 7065 or approximately 82 comcidences of smgle letters 
Exammmg the 


d1stnbution 1t 1s found that there are 83 comc1dences1 as shown below 


~ 
~~ 
~-~~~ 
~ 
~~~~ 
~~ 
~~~~ 
~~- 
~ 
ABCDEFGHIJKLMNOPQRSTUVWXYZ 
s+o+o + 1+21+ o +o+ 1 +a +o+ o+o +1 +10+1s+o +o +i +10+1s+ 1 +0+1 +o +o +o -83 
The actual number of comcidenres agrees very closely with the theoretical number, which is 
of course to be expected, smce the text to which the dlStnbution apphed has been md1cated as 
bemg normal plam text 
b In the foregomg S1IDple demonstration, let the number of comparisons that can be made 
N(N-1) 
m the d1stnbution be mdicated symbobcally by 
2 


1 where N=the total number of letters 


m the distnbution 
Then the expected number of comc1dences may be wntten as 0067 ~(N- l), 


which may then be rewritten as 


(I) 
0067NJ- 0667N 


2 


c Likewise, if f .t represents the number of occurrences of A m the foregomg d1str1bution, 


then the number of comcidences for the letter A may be mdicated symbohcally byfA(j~-l) 


And SlIDllarly, the number of comcidences for the letter B may be indicated by f s~- l) 1 and 


so on down to fz(fz-1) 
The total number of actual comc1dences found m the dIStnbution is, 


2 
of course, the sum of fA(f2-1) +fs<f;-1) + 
fz(f;-1) If the symbol fa is used to mdicate 


any of the letters A, B, 
Z, and the symbol l': 1s used to mdicate that the qum of all the 


1 MildaT'JI Cryptanalyna, Part II, Appendix 2 
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elements that follow this mgn is to be found, then the sum of the actual comcidences noted m 


the distnbutJ.on may be mdicated thus ~ie(f~-l), which may be rewritten as 


(II) 


d Now although denved from chfferent sources, the two expressions labeled (I) and (II) 
above are equal, or should be equal, m normal pla.m text 
Therefore, one may wnte 


Srmphfymg this equation 


0667 N"- 0667 N 
2 


(III) 
!.fe2-!.fe= 0667N"- 0667N 


e Now"Xfa=N 


Therefore, expresSlon (Ill) may be wntten as 


(IV) 
!.fe2-N= 0667N"- 0667N, 
which on reduction becomes 
(V) 
"Xfe2= 0667 N"+ 9333N 


This equation may be read as "the sum of the squares of the absolute frequencies of a d1StnbutJ.on 
is equol to 0667 trmes the square of the tota.1 number of letters m the d1StnbutJ.on, plus 9333 
times the total number of letters m the dlBtnbutJ.on " 
The letter 8 2 lS often used to replace the 


symbol !.fe2 


f Suppose two monoalphabetic distnbutions are thought to pertain to the s.tme cipher 


alphabet 
Now if thev actually do belong to the same alphabet, and If they are correctly 8 


combmed mto a Single distnbution, the latter must still be monoalphabetic m character 
That 


is, agam represcntmg the mdiv1dual letter frequencies m one of these dlStnbutions bv the general 
symbol fe1 the mdiVIdual letter frequenc1esm the other d1stnbut1on by fe2, and the total frequencv 
m the first distnbut1on by Ni, that m the second distribution by N 2, then 


(VI) 


Expanding the terms of this equation 


(VII) 
!.fe1 
2+2"1:.fei/ea+!.fe2 
2= 0667(N12+2N,N2+N22)+ 9333N1+ 9333N2 


But from equation (V) 
!.fe1 
2= 0667N12+ 9333N, and 


!.fea2= 0667 Nl+ 9333N2, 


so that equation (VII) may be rewritten thus 


0667N,2+ 9333N,+2r.fedea+ 0667N:l+ 9333N2= 


0667(N12+2N1N2+Nl)+ 9333N,+ 9333N2 


3 By "correctly" is meant that the two d1Str1butions are slid relative to each other to their proper super- 
impos1t1on 
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Reducing to smi.plest terms by cancellmg out smular expresSions 


2!.fadaa= 0667(2N1N2), or 


(VIII) 
'!.fada2= 0667 
N1N2 


g The laat equation th'U8 permits of establ.ishing an expected value for the sum of the products 


of the corresponding frequencies of the two distributions being considered for amalgamation 
The 


cross-product sum or x test for matching two distributions u based upon equation (VIII) 
48 Applying the x test in matching distributions -a Suppose the followmg two dlStribu- 
tJ.ons are to be matched 


ft-------------- A B c D E F G H I J K L M N 0 p Q R s T u v w x y z 


fa-------------· A B c D E F G H I J K L M N 0 p Q R s T u v w x y z 


Let the frequencies be Juxtaposed, for convenience m findmg the sum of the cross products 
Thus· 


fea-·----------------- 1 4 0 3 0 1 0 0 1 0 0 1 0 0 1 0 0 3 2 2 1 0 1 3 0 2 _____ N1=26 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 
fa.------------------- O 2 O O O 3 O O 1 O 1 O o 1 1 o O 3 1 1 o o o o 1 2 _____ N~=17 
f e1 f e2- ------------- 0 8 0 0 0 3 0 0 1 0 0 0 0 0 1 0 0 9 2 2 0 0 0 0 O 4 


In this case Ifede,=8+3+1+1+9+2+2+4=30 


N1N2=26X17=442 


b The fact that the quotient ( 0711) agrees very closely with the expected value ( 0667) 


means that the two distnbut1ons very probably belong together or are properly matched 
Note 
the qualifying phrase "very probably " It imphes that there is no certainty about this busmess 
of matching d1stnbut1ons by mathematical methods 
The mathematics serve only as measunng 
deV1ces, so to speak, which can be employed to measure the degree of smulanty that exists 


c Instead of diVIdmg I.fade, by N 1N 2 and seemg how closely the quotient approximates the 
value 0667 or 0385, one may set up an expected value for "1:.f adea and compare it with the ob- 
served value 
Thus, m the foregomg example 0667 (N1N2)= 0667X422=28 15, the observed 
value of I.fadaa is 30 and therefore the agreement between the expected and the observed values 
is qwte close, mdicatmg that the two distribut10ns are probably properly matched 
d There are other mathematical or statistical tests for matching, m addition to the x test 
Moreover, it is possible to go further with the x test and find a measure of the rehance that may 
be placed upon the value obtained, but these pomts will be left for future discuSSion m subse- 
quent texts 


1311922-39--6 
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e One more pomt will, however, here be added m connection with the x test 
Suppose 


the very same two chetnbutions m subparagraph a are agam Juxtaposed, but with fa. shifted one 
mterval to the left of the position shown m the subparagraph of reference 
Thus 


{ 
1 4 O 3 O 1 O o 1 o o 1 o o 1 o o 3 2 2 1 o 1 3 o 2 ______ N1 =26 
f ai--- ------------- A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 


{ 
B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z A ______ N2= 17 
f •--- ------------ 2 0 0 0 3 0 0 1 0 1 0 0 1 1 0 0 3 1 1 0 0 0 0 1 2 0 


and 
'1'fada!= 10 = 0226 
N1N. 
442 


The observed ratio ( 0226) is so much smaller than the expected ( 0667) that it can be said that if 
the two chetnbut1ons pertam to the same pnmary components they are not properly supenmposed 
In other 'IJ)()rtU, the x tut may aho be applied in caseB where f'IJ)() or morejreg:uency distrilrutionB mwt 
be shifted relatively in order to find their correct 8'UperimpoBitwn 
The theory underlymg this apph- 
cation of the x test 18, of course, the same as before two monoalphabetic chetnbutions when prop- 
erly combmed will yield a smgle distnbution which should still be monoalphabetic m character 
In applying the x test m such cases it may be necessary to shift two 26-element chetnbutlons to 
various super1lllpositions, make the x test for each supenmpoBltion, and take o.s correct that one 
which yields the best value for the test 
f The nature of the problem will, of course, determine whether the frequency dlStnbutions 
which are to be matched should be compared (1) by direct supenmpoBltion, that is, setting the A 
to Z tallies of one distnbut1on directly oppoSlte the correspondmg tallies of the other dlStnbution, 
e.s m subparagraph a, or (2) by shifted supenmpomtion, that 18, keeping the A to Z tallies of the 
first dlStnbution fixed and shdmg the whole sequence of tallies of the second dlStnbution to 
various supenmpomtions against the first 


SECTION XIII 


APPLYING THE CROSS-PRODUCT OR x TEST 


Para graph. 


Study of a situation in wb.J.ch the x test may be apphed--------------- ------------------- ------------------------------ 
49 
Solution of a piogressive-alphabet system bv means of the x test.----------------------------------------------------- 
50 
Alternative method of solution 
-- -- _ _ ----- --------- ----------------- -------- ---- ---------------------------------- 
51 
49 Study of a Sltuatlon m wluch the x test may be apphed -a A simple demonstration 


of how the x-test 18 apphed m matching frequency dlStnbutions may now be set before the 
student 
The problem mvolved 18 the solution of cryptograms enciphered a.ccordmg to the 
progresBlve-o.lphabet system (par 36b), with secondary alpha.bets denved from the mteraction 
of two identical JlllXed primary components 
It will be assumed that the enemy has been usmg 
a system of this kmd and that the pnmary components are changed da.tly 
b Before attacking an actuo.1 problem of thlB type, suppose a few mmutes be devoted to a 
general analys1B of its elements 
It 18 here a.sswned that the primary components a.re based 
upon the HYDRAULIC 
Z sequence and that the cipher component is shifted toward the 
nght one step at a time 
Consider a cipher square such as that shown m Figure 12, which is 


apphce.ble to the type of problem under study 
It has been arranged m the form of a deciphenng 
square 
In this square, the horizontal sequenceB are all. identical but merely shifted relatively, the 


letters inside the square are p'lain-text letters 
(79) 


• 
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ALPHABI!.T No 


l 
2 
3 
" 
5 
6 
7 
8 
9 
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


A A U L I C B E F G J K M N 0 P Q S T V W X Z H Y D R 
B B E F G J K M N 0 P Q S T V W X Z H Y D R A U L I C 
C C B E F G J K M N 0 P Q S T V W X Z H Y D R A U L I 
D DRAULICBEFGJKMNOPQSTVWXZHY 
E E F G J K M N 0 P Q S T V W X Z H X D R A U L I C B 
F F G J K M N 0 P Q S T V W X Z H Y D R A U L I C B E 
G G J K M N 0 P Q S T V W X Z H Y D R A U L I C B E F 
H H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z 
I 
I C B E F G J K M N 0 P Q S T V W X Z H Y D R A U L 
J 
J K M N 0 P Q S T V W X Z H Y D R A U L I C B E F G 


~ K KMNOPQSTVWXZHYDRAULICBEFGJ 
EL LICBEFGJKMNOPQSTVWXZHYDRAU 


~ M MNOPQSTVWXZHYDRAULICBEFGJK 


~ N NOPQSTVWXZHYDRAULICBEFGJKM 


~ 0 OPQSTVWXZHYDRAULICBEFGJKMN 
o P PQSTVWXZHYDRAULICBEFGJKMNO 


Q QSTVWXZHYDRAULICBEFGJKMNOP 
R R A U L I C B E F G J K M N 0 P Q S T V W X Z H Y D 
S S T V W X Z H Y D R A U L I C B E F G J K M N 0 P Q 
T T V W X Z H Y D R A U L I C B E F G J K M N 0 P Q S 
U U L I C B E F G J K M N 0 P Q S T V W X Z H Y D R A 
V V W X Z H Y D R A U L I C B E F G J K M N 0 P Q S T 
W W X Z H Y D R A U L I C B E F G J K M N 0 P Q S T V 
X X Z H Y D R A U L I C B E F G J K M N 0 P Q S T V W 
Y Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z H 
Z Z H Y D R A U L I C B E F G J K M N 0 P Q S T V W X 


[Plam text letters are w1thm the square proper] 


FIOUllJI: 12 


• 
c If, for mere purposes of demonstration, mstead of letters w1thm the cells of the square 
there are placed tallies correspondmg m number with the normal frequencies of the letters 
occupymg the respective cells, the cipher square becomes as follows (showmg only the 1st 
three rows of the square) 


ALPHABET No 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 


:::: 
~ 
~ 
~ 
~ ~ 
- ~ 
~~~§~~~~~:::: __ ~~~~--~~~~ 
:::: 
~ 
~ ~ 
- 
B - 
~ ~ ~ 
~ g ~ ~ 
~ 
i----------------- ---- - - 
::: 


~ - - 


:::: - :::: 


FIOUBB 13a 


=:- 
- 
::.:: 
~ ::::: 
~ ~ ~ ~ z ~ - 


:::: 
::::: 
~ 
::.:::=:§~2::.:~~ 
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d It is obvious that here is a case wherem if two chstribut10nci pertnmmg to the square are 
isolated from the ciquare, the x tecit (matchmg distnbut10ns) can be applied to a..,certam how the 
distnbut10n.., cihould be slufted relative to each other so thnt they rnn be supPIImposed and made 
to yield a monoalphabchC' wmpos1te 
There lb obv10ubly one correct super1mpo.,ihon out of 25 
pos ... 1b1ht1es 
In this cai;.e, the Brow of talhet> must be displaced 5 mterv.ils to the ught m order 
to match it and amalgamate it with the A row of talhes 
Thu.., 


:::: 
::: 
~ 
::: 
- 
-:::: 
A ~ ~ 


.::_ 
it. 
2::: 
:g. 
~ 
'12 ~ ~ 
"" 
.... 
~ 
"is 
1 
, 4 
5 
6 
7 
10 
11 
11 l4 


~ - 


5 
6 ~ :.?' 
~ :::,0 
7 
8 
J 


-:::: 
=::: 
- - 
:E if 
- - 
z. 
16 
17 
18 -\q )o .II 
22 
21 '::4 /; 26 


- 
~ 
- 
~ ~ - - 
~ :::: 
~ ~ 
11 
12 n 
14 
15 
16 
17 
18 
19 .o 
.II 


e Note that the amount of displacement, that is, the number of mtervals the B sequence 
must be shifted to make it match the A sequence m Figure 13b, corresponds exactly to the distance 
between the letters A and B m the pnmary cipher eomponent, which is 5 mtervals 
Thus 
012345 
A U L I C B 
The fact that the pnmary plam component ici m tluci ca"le identical 
with the pnmary cipher component has nothmg to do \\<1th the matter 
The displacement interval 
is being measured on the ciphe1 component 
It is important that the student see this pomt very 
clearly 
He can, if he hke, pro'\ e the pomt by e-cpenmentmg with two d1ff crent primary com- 
ponents 
f Assummg that a message m such a sybtem i.., to be solved, the text is transcnbed m ro\\s 


of 26 letters 
A umhteral frequency distnbut10n is made for each column of the transcribed 
text, the 26 separate distnbut1ons bemg compiled w1thm a smgle square such as that shown m 
Figure 14 
Such a square may be termed a frequency distributwn sqoore 


g Now the vertical columns of tallies withm such a d1stnbution square constitute frequency 


distnbut10ns of the usual type They show the d1stnbution of the vanous cipher letters m each 
cipher alphabet 
If there were many Imes of text, all arranged m penods of 26 letters, then each 
column of the frequency square could be solved m the usual manner, by the application of the 
simple pnnciples of monoalphabetic frequency 
But what <lo the horizontal rows of tallies 
withm the square represent? Is it not clear that the first such row, the A row, merely shows the 
distribution of A0 throughout the succesSlve cipher alphabets? And does not this graphic picture 
of the distribution of A0 correspond to the sequence of letters composing the primary pl,ain oomponent1 
Furthermore, is it not clear that what has been said of the Aro\\ of talhes applies equally to the 
B, C, D, 
Z rows? Fmally, is it not clear that the graphic pictures of ell the d1st11but1ons 
correspond to the same sequence of letters, except that the sequence begms with a different letter 
m each row? In other words, all the honzonte1 ro\\s of talhes withm the d1str1buhon square 
apply to the same sequence of plam-text letters, the sequences m one row merely begmmng with 
a different letter from that with which another row begms 
The sequences of letters to which 


the tallies apply m the var10us rows are merely displaced relative to one another 
Now if there 


are sufficient data for stat1st1cal purposes m the vanous honzontal bequences of tallies w1thm the 
dist11but1on square, these sequences, bemg approximately b1mila1, con be studied by meanc; of 
the x test to find their rPlatii•e di~placement~ 
And m findmg the latter a method is p10v1ded 
whereby the pnmary cipher component may be reconstrueted, smce the correct absemblmg of 
the displacement data will yield the sequenee of letters f'onstitutmg the primary cipher component 
If the plam eomponent l"I ulentic1tl with the e1pher component, the c;;olution i.., immediately ni 
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hand, if they are drlferent, the solution is but one step removed 
Thus, there has been elabo- 
b The message is transcnbed m Imes of 26 letters, smce that is the total number of secondary 
rated a method of solvmg tins type of cipher system without making any asBUmptwns of values 
alphabets m the system 
The transcnbed text is shown below 
for cipher letters 
1 i a ' s e 7 a o ro u u D u ~ ~ u ~ ro m ~ n • H • 
• 
60 Solution of a progressive-alphabet system by means of the x test -a The followmg 
1 
W G J J M M M J X E D G C 0 C F T R P B M I I I K Z 
cryptogram has been enciphered accordmg to the method indicated, by progressive, simple, 


2 RYNNBUFRWWWWYOIHFJKOKHTTAZ 
uninterrupted sh1ftmg of a pnmary cipher component agamst an identical pnmary plam 


3 CLJEPPFRWCKOOFFFGEPQRYYIWX 
component 


CRYPTOGRAM 
4 MXUDIPFEXMLLWFKGYPBBXCHBFY 


I E T X H F B I V D I P N X I V R P W T M G I M P T 
5 
W G J JM 
MM J XE 
D G C 0 C 
FT RP B 
M I I I K 
ZRYNN 
6 ECJBOKVBUQGVGFFFKLYYCKBIWX 
BU FR W w w w y 0 
I HF J K 
0 K HT T 
A Z C L J 
E P P F R 
7 MXUDIPFFUYNVSSIHRMHYZHAUQW 
W C K 0 0 
F F F G E 
p QR y y 
I W X M X 
U D I P F 
EX ML L 
8 
G K T I U X Y J J A 0 W Z 0 C F T R P P 0 Q U S G Y 
W F KG Y 
P B B X C 
H B F Y I 
ET X HF 
B I V D I 
P N XIV 
9 CXVCXUCJLMLLYEKFFZVQJQSIYS 
RP WT M 
G I M P T 
EC J B 0 
KV BU Q 
G VG FF 
F KL Y Y 
10 PDSBBJUAHYNWLOCXSDQVCYVSIL 
CK BI W 
XMXUD 
I P F F U 
Y NV SS 
I HR M H 
Y Z HAU 
11 IWNJOOMAQSLWYJGTVPQKPKTLHS 
Q W GK T 
IUXYJ 
J A 0 W Z 
0 CF TR 
p p 0 Q u 
S G Y C X 
12 ROONICFEVMNVWNBNEHAMRCROVS 
v c x u c 
J L ML L 
YE K FF 
z v Q J Q 
S I Y S P 
D SB BJ 
13 TXENHPVBTWKUQIOCAVWBRQNFJV 
UAHYN 
W L 0 C X 
S D Q V C 
Y VS IL 
I W NJ 0 
0 MA Q S 
14 NRVDOPUQRLKQNFFFZPHURVWLXG 
LWYJG 
TV P Q K 
PKT L H 
SR 0 0 N 
I C F E V 
MN V W N 
15 SHQWHPJBCNNJQSOQORCBMRRAON 
BNEHA 
MR CR 0 
VS TX E 
NHPVB 
T WK U Q 
I 0 C A V 
16 RKWUHYYCIWDGSJCTGPGRMIQMPS 
WBRQN 
F JV N R 
VD 0 PU 
QR LKQ 
N F F F Z 
PHURV 
17 GCTNMFGJXEDGCOPTGPWQQVQIWX 
W L X GS 
HQ W HP 
J B C N N 
J Q s 0 Q 
0 RC BM 
RR A 0 N 
18 TTTCOJVAAABWMXIHOWHDEQUAIN 
RKWUH 
Y Y CI W 
D GS JC 
T GP GR 
MI QM P 
S G C T N 
19 FKFWHPJAHZITWZKFEXSRUYQIOV 
MFG J X 
E D G C 0 
P T G P W 
Q Q V Q I 
W X TT T 
C 0 JV A 
20 RERDJVDKHIRQWEDGEBYBMLABJV 
AABWM 
X I H 0 W 
HD E Q U 
A I N F K 
F W HP J 
AH ZIT 
21 TGFFGXYI VGRJ YEKFBEPBJ OUAHC 
W Z K FE 
XSRUY 
QI 0 V R 
ER DJ V 
DK HI R 
Q WED G 
22 UGZLXIAJKWDVTYBFRUCCCUZZIN 
EBYBM 
LAB JV 
T G FF G 
X YI VG 
R J YE K 
F B E P B 
23 NDFRJFMBHQLXHMHQYYYMWQVCLI 
J 0 U AH 
CU G Z L 
XI A J K 
W D VT Y 
BF RU C 
cc u z z 
24 PTWTJYQBYRLITUOUSRCDCVWDGI 
INN D F 
R J FM B 
HQLXH 
MHQYY 
YMWQV 
C L I P T 
25 GGUBHJVVPWABUJKNFPFYWVQZQF 
WTJYQ 
BY R LI 
TU 0 US 
R C D C V 
W D G I G 
GU B HJ 
26 LHTWJPDRXZOWUSSGAMHNCWHSWW 
V VP WA 
BU J KN 
F PF Y W 
V Q Z Q F 
L H T W J 
PD RX Z 
27 LRYQQUSZVDNXANVNKHFUCVVSSS 
0 wuss 
GAMHN 
CW HS W 
WLR Y Q 
Q us z v 
DNXAN 
28 
p L Q U P C V V V W D G S J 0 G T C H D E V Q S I J 
VNKHF 
u c v vs 
S S P L Q 
u p c v v 
V W D GS 
J 0 G T C 
29 PHQJAWFRIZDWXXHCXYCTMGUSES 
HDEVQ 
SI JP H 
QJAWF 
R I Z D W 
XX H C X 
Y CT MG 
30 NDSBBKRLVWRVZEEPPPATOIANEE 
USES N 
D SB BK 
RLVWR 
V ZEE P 
PP AT 0 
I A N E E 
31 EEJNRCZBTBLXPJJKAPPMJEGIKR 
EEJNR 
C Z B T B 
L X P J J 
KAPP M 
J E G I K 
RT G FF 
32 TGFFHPVVVYKJEFHQSXJQDYVZGR 
HPVVV 
Y K J E F 
HQSXJ 
Q DY V Z 
GRRHZ 
QLYXK 
33 RHZQLYXKXAZOWRRXYKYGMGZBYN 
X AZ 0 W 
RRXYK 
Y GM G Z 
BYNVH 
QB RV F 
E F Q LL 
34 VHQBRVFEFQLLWZEYLJEROQSOQK 
WZEYL 
J E R 0 Q 
S 0 Q K 0 
MW I 0 G 
MBKFF 
L X DX T 
35 OMWIOGMBKFFLXDXTLWILPQSEDY 
L WI LP 
Q SEDY 
I 0 E M 0 
I BJ ML 
NNSYK 
X J Z JM 
36 IOEMOIBJMLNNSYKXJZJMLCZBMS 
LC Z BM 
SD J W Q 
X T JV L 
F I R N R 
XHYBD 
BJ U FI 
37 DJWQXTJVLFIRNRXHYBDBJUFIRJ 
R J I C T 
UUUSK 
KWDVM 
F WT T J 
K C K C G 
CVS AG 
38 ICTUUUSKKWDVMFWTTJKCKCGCVS 
QB CJ M 
EBY NV 
S S J K S 
DCB DY 
F P P V F 
D W Z MT 
39 AGQBCJMEBYNVSSJKSDCBDYFPPV 
BPVTT 
CG B VT 
Z K HQ D 
DR ME Z 
0 0 
40 FDWZMTBPVTTCGBVTZKHQDDRMEZ 
41 
0 0 
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c A frequency d1stnbut1on square is then compiled, each column of the text forming a 
separate d1stnbut1on m columnar form m the square 
The latter is shown m figure 14 


A 


B 
c 


D 


E 


F 


G 


H 


I 


J 


K 


L 


M 


N 


0 


p 


Q 


R 
s 


T 
u 
v 
w 
x 


y 


z 


1 
? 
3 
4 
~ 
ff 
7 
8 
9 
10 11 12 13 14 15 
16 17 
18 19 20 21 22 23 24 25 
26 


-1 I I 1-1 1-1 ~ 1-1 ~ 1-1 1-1 I I I 
~ l 1 
~ l I -! 1 
~ I 
~ 1-1 


111~1~11~1~1-1-1-1-11--1~11-1~1-1~111-1~11 


~1~1 1~1-1~1-1-1-1-1 1-1~1 i~l~I 1-1g1~1~1§1 l~I 1- 


~li§I 1~1 I l~I I l~l~I I 1--1-1 
l~I 1-1~1~1-1 1-1-1 


'1~1~1-1 I I 1%/ 
l~I I 1-1~1~1 1~1'1-1 1'1-1 1-1~1- 


~, l~l'I 1~1~1-1-1~1-1 I 1~1~1~1~1 l~I I I 1~1-1-1- 


~1~1 I 1-1-1-1 I 1-1-1~1~1 1-1g1~1 1-1-1 l~l'I 1~1~ 


1~1 I l~I I I 1~1 I I 1-1 
l~lgl 1~1~1 I l~l~I 1~1- 


~1 I 1~1~1~1 1~1~1-1~1-1 1-1~1 I I 1-1 I 1~1~1~1~1~ 


1-1~1~1~1~1~1~1-1 I 1~1 1~1~1 1-1~1~1 1~1 I I ,~,~ 


1~1 I I l~I 1~1~1 1~1 I I 1~1'1~1~1~1-1~1~1 I 1~1- 


~l~I 1-1-1 I 1-1~1~1~1%1-1 I I 1~1-1 1-1-1-1 1~1~1- 


~,-, 1-1~1-1~1 1-1~1 I 1~1-1 I I 1--1 
1~1~1 I 1~1-1 


~1 1~1~1 I I I I 1--1~1-1~1~1 1~1 I I 1-1 I 1-1-1 1~ 


~1~1--1 1~1-1 I I I 1~1~1-1~1~1 l~I I 1-1~1-1 1~1~1 


~1 I I l~l~I 1-1-1 I 1-1-1 1-1-1-1~1~1-l'I I I' 1~1 
I 1~1~1-1 1-1-1-1~1 I~!~! I 1~1 I 1~1~1-1~1~1 1~1 


~1,1-1-1~1 ,-,~1--1--1~1-1 1'1-1 
1~1~1 1~1%1-1~1 1~1~ 
-1 
l~I I I l~I I 1-1 I 1~1~1-1 1~1 1-1 I I 1~1~1-1~ 


~1~1~1-1 l~I I 1~1-1-1-1~1 I 1~1~1 I 1~1 I 1~1--1 1- 
'I 1~1~1~1~1~1 l~I I 1-1~1-1 1-1 1-1 
1~1-1'1~1--1 I 
-1 
l~I I l'/~1~1:1 I l~I I 1~1-1-1-1-1-1 1~1g1 1~1~ 


--1-1~1~1 1--1 I 1~1~1--1~1~1 1-1 I l'l~I 1~1-1~1 lgl~ 


1~1 1--1~1~1-1 1~1 I 1~1~1~1~1~1-1~1 I 1-1 I I 1--1~ 
1-1-1 I 1~1~1 1-1~1 I 1~1~1 1--1~1~1~1~1 1~1--1 1~1~ 
l 1~1--1 I 1-1-1 
1~1-1 1~1~1 I l~l~I I 1-1 
1~1~1 1~ 


l 
2 
3 
4 
6 
6 
7 
8 
9 
10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 
26 
Fmuu 14 


N 


25 


43 


45 


35 


61 


39 


88 


:r1 


31 


37 


45 


46 


39 


39 


52 


37 


44 


1 OU 
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d The ~ test will now be apphed to the honzontal rows of talhes in the distribution square, 
m accordance with the theory r.et forth m paragraph 49g 
Smrn tlus test is purely statistical 
m character and becomes mcreasm~ly reliable as the size of the distnbut1ons mcreases, it is best 
to start by workmg with the two d1btr1but10ns haVlilg the greatest total numbers of talhes 
These are the V and W d1stnbut1ons, with 53 and 52 occurrences, respectively 
The results of 
three relative dio;placements of these two distnbut1ons are shown below, labeled "First tei;;t," 
"Second test," and "Thud test" 


Ir{ ~ 
0 2 0 0 2 6 4 
2 3 4 5 6 7 8 


I {24 25 26 1 2 3 4 5 
.,, 0 4 2 1 1 5 3 0 


!v/w 0 0 4 0 0 10 18 0 


FIRST TEST 


8 0 0 7 0 0 2 1 1 1 1 1 0 6 4 0 2 4 
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 
1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 


8 0 0 14 0 0 14 6 0 1 0 0 0 18 0 0 2 8 


"t.f vfw = 103 = 037 
NrNw 2756 


SECOND TEST 


Nv=53 


Nw=52 


l:/v/w=103 


{ 
1 o 2 O O 2 6 4 8 0 0 7 O 0 2 1 1 1 1 1 0 6 4 0 2 4 
Nv=53 


Ir 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


I { 
18 19 20 21 22 23 24 25 26 
1 2 3 4 5 6 6 8 9 10 11 12 13 14 15 16 17 


" 
2 
3 o 2 1 2 0 4 2 1 1 5 3 
0 1 0 0 2 8 1 7 6 0 1 0 O Nw=52 


fvf.,, 2 0 0 0 0 4 0 16 16 0 0 35 0 0 2 
0 0 
2 8 1 0 36 0 0 0 
0 
"t.fvfw= 122 


l:fvlw = 122 = 044 
NvNw 2756 


THIRD TEST 
f 1 0 2 0 0 2 6 4 8 O 0 7 0 0 2 
'1 
1 1 1 1 0 6 4 0 2 4 
Nv=53 
fvl 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


{ 
4 5 6 7 8 g 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 


,.,, 3 0 1 0 0 2 8 1 7 6 0 1 0 0 2 3 0 2 1 2 0 4 2 1 1 5 
Nw=52 


fv/1' 3 
O 2 0 0 4 48 
4 56 0 0 7 0 0 4 3 
0 
2 1 2 0 24 8 0 2 20 
!./vi w= 190 


"t.f vfw = 190 = 069 
NvNw 275b 


e Smee the last of the three foregomg tests gives a value somewhat better than the expected 


0661, 1t looks as though the correct pos1t1on of the W d1stnbut1on with reference to the V d1stnbu- 
tJ.on has been found 
In pre.ct1C'e, several more teats would be made to msure that other close 


approxunat1ons to 0667 will not be found, but these will here be omitted 
The test mdicates 


1 
2 
3 
' 


that the pnmary cipher component has the letters V and Wm these positions V 
W, smce 
the correct supenmp0Slt1on requrres that the 4th cell of the W d1Stnbut1on must be placed under 
the 1st cell of the V d1c;tnbut1on (see the last supenmpos1t1on above) 
f The next best d1stnbut1on with wluch to proceed is the F d1stnbut1on, with 51 occurrences 


Paralleling the procedure outlined m paragraph 43, and for the same reasons, the F sequence 


IS matched agamst the Wand V sequences separately and then agamst both Wand V sequences 


I 
,' 
I 
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at their correct supenmposit10n 
The followmg shows the correct relative pos1t1ons of the three 


dIStnbutions 


{ 
1 0 
2 0 0 
2 6 4 8 0 0 
7 0 0 2 
1 1 1 1 1 0 
6 4 0 2 4 
fv 1 2 3 
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


f { 
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
1 2 3 
4 5 6 7 


F 1 1 2 
1 0 0 6 3 9 3 0 2 0 0 
Q 2 
1 1 1 2 0 4 2 0 
3 7 


fvf F 1 0 
4 0 0 0 36 12 72 
0 0 14 0 0 
Q 2 1 
1 1 2 0 24 8 0 6 28 


'I.j vfF = 212 = 078 
NvNr 2,703 


Nv=53 


N,=51 


I.fvfF=212 


{ 
1 1 
f w 1 2 5 3 0 
1 0 0 2 8 
1 7 6 
O 1 0 0 
2 3 
O 2 
1 2 0 4 2 
Nw=52 
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


{ 
5 6 
,., 0 3 
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
1 2 3 4 
7 
1 1 2 
1 0 0 6 3 
9 3 0 2 0 0 0 2 
1 1 1 2 0 4 2 
N.,=51 


f wf., 0 3 35 
3 0 2 0 0 0 48 3 63 18 0 2 0 0 0 
6 0 
2 
1 4 0 16 4 
'Zfwf .,=210 


'Zf wf., == 210 = 078 
NwNr 2,703 


{4 O 3 O O 4 14 5 15 6 0 8 0 O 4 4 
1 3 2 3 0 10 6 
1 3 9 
N1+w= 105 


J(v+w) 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 


f { 
8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
1 2 3 
4 5 6 7 


' 1 1 2 
1 O 0 6 3 9 3 0 2 0 0 0 2 1 1 1 2 0 
4 2 0 3 7 
N.,=51 


J(v+w)fF4 0 
6 0 0 0 84 15 35 18 0 16 0 0 0 8 1 3 2 6 0 40 12 0 9 63 
I.f cv+w>/11=422 


I.fcv+wJ.,= 422 = 079 
N<v+wiN., 5,355 


i 
2 a • a e 1 s 


The test yields the sequence V 
W 
F 


g The process is contmued m the foregomg manner unttl the entire pnmary cipher com- 
ponent has been reconstructed 
It 1s obvious that as the work progresses the cryptanalyst is 


forced to employ smaller and smaller distnbut10ns, so that statistically the results are apt to 
become less and less certam 
But to counterbalance this there is the fact that the number of 
possible supenmpos1t10ns becomes progressively smaller as the work progresses 
For example, 
at the commencement of opcrat10ns the number of possible pomts for supenmposmg a second 
sequence agamst the first is 25, after the relative pos1t10ns of 5 d1stnbut10ns have been ascer- 
tamed and a 6th d1stnbut1on 1& to be placed m the pnmary sequence bemg reconstructed, there 
are 21 possible pos1t10ns, after the relative pos1t10ns of 20 d1stnbut1ons have been ascertamed, 
there are only 6 possible pos1t10ns for the 21st d1stnbut10n, and so on 
h In the foregomg case the completely reconstructed pnmary cipher component 1s as 
follows 
1 
2 
3 
4 
5 
6 
7 8 
9 W ll U 
~ W ~ M n ~ ~ ~ " 
~ ~ ~ ~ Z 


V A L W N 0 X F B P Y R C Q Z I G S E H T D J U M K 


Smee it was stated that the problem mvolves identical pnmary components, both components 
are now at hand 
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i Of course, it is probable that m practical work the process of matchmg d1stnbut10ns 


would be mterrupted soon after the pos1t10ns of only a few letters m the pnmary component had 
been ascertamed 
For by trymg partially reconstructed sequences on the cipher text the skele- 
tons of some words would begm to show 
By fillmg m these skeletons with the words suggested 
by them, the process of reconstructmg the components 1s much facilitated and hastened 
J The components havmg been reconstructed, only a moment or two is necessary to as- 
certam their 1mtial pos1t10n m enc1phermg the message 
It lS only necessary to Juxtapose the 
two components so as to give "good" values for any one of the vertical d1str1but10ns of Figure 14 
This then gives the 1uxtapos1t10n of the components for that column, and the rest follows very 
easily for the plam text may now be obtamed by direct use of the components 
The plam text 
of the message is as follows 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 11 
12 13 14 15 16 17 18 19 20 21 
22 23 24 25 26 
1 
W G J J M M M J X E D G C 0 C F T R P B M I I I K Z 
W I T H T H E I M P R 0 V E M E N T S I N T H E A I 
2 
R Y N N B U F R W W W W Y 0 I H F J K 0 K H T T A Z 
R P L A N E A N D T H E M E A N S 0 F C 0 M M U N I 


3 CLJEPPFRWCKOOFFFGEPQRYYIWX 
C A T I 0 N A N D W I T H T H E V A S T S I Z E 0 F 
4 
M X U D I P F E X M L L W F K G Y P B B X C H B F Y 
M 0 D E R N A R M I E S S T R A T E G I C S U R P R 
5 
I E T X H F B I V D I P N X I V R P W T M G I M P T 
I S E W I L L B E C 0 M E H A R D E R A N D H A R D 
6 
E C J B 0 K V B U Q G V G F F F K L Y Y C K B I W X 
E R T 0 A T T A I N X I N T H E P R E S E N C E 0 F 
7 
M X U D I P F F U Y N V S S I H R M H Y Z H A U Q W 
M 0 D E R N A V I A T I 0 N A N D F A S T M 0 V I N 
8 
G K T I U X Y J J A 0 W Z 0 C F T R P P 0 Q U S G Y 
G M E C H A N I Z E D E L E M E N T S G R E A T E R 
9 
C X V C X U C J L M L L Y E K F F Z V Q J Q S I Y S 
C 0 M P L E X I T I E S M 0 R E S U B T L E D E C E 


10 
P D S B B J U A H Y N W L 0 C X S D Q V C Y V S I L 
P T I 0 N S S T R A T E G E M S A N D F E I N T S W 
11 
I W N J 0 0 M A Q S L W Y J G T V P Q K P K T L H S 
I L L H A V E T 0 B E E M P L 0 Y E D X I N M 0 D E 
12 
R 0 0 N I C F E V M N V W N B N E H A M R C R 0 V S 
R N W A R F A R E I T I S S T I L L P 0 S S I B L E 


13 
T X E N H P V B T W K U Q I 0 C A V W B R Q N F J V 
T 0 G A I N T A C T I C A L S U R P R I S E B Y M A 
14 
N R V D 0 P U Q R L K Q N F F F Z P H U R V W L X G 
N Y M E A N S X W H I L E T H E M E A N S 0 F 0 B S 
15 
S H Q W H P J B C N N J Q S 0 Q 0 R C B M R R A 0 N 
S E R V I N G A N D T R A N S M I T T I N G I N F 0 
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l 
2 
3 
4 
Ii 
6 
7 
8 
9 
10 11 12 13 14 15 16 17 18 19 20 21 22 21 24 25 26 
16 
R K W U H Y Y C I W D G S J C T G P G R M I Q M P S 
R M A T I 0 N 0 F T R 0 0 P M 0 V E M E N T S A R E 
17 
G C T N M F G J X E D G C 0 P T G P W Q Q V Q I W X 
G R E A T L Y I M P R 0 V E D 0 V E R T H 0 S E 0 F 
18 
T T T C 0 J V A A A B W M X I H 0 W H D E Q U A I N 
T H E P A S T T H E M E C H A N I C A L M E A N S 0 


19 
F K F W H P J A H Z I T W Z K F E X S R U Y Q I 0 V 
F M 0 V I N G T R 0 0 P S A R E L I K E W I S E F A 


20 
R E R D J V D K H I R Q W E D G E B Y B M L A B J V 
R S P E E D I E R X A L S 0 F A L S E I N F 0 R M A 
21 
T G F F G X Y I V G R J Y E K F B E P B J 0 U A H C 
T I 0 N C A N B E F A R M 0 R E E A S I L Y A N D Q 
22 
U G Z L X I A J K W D V T Y B F R U C C C U Z Z I N 
U I C K L Y D I S T R I B U T E D X T H E L E S S 0 
23 
N D F R J F M B H Q L X H M H Q Y Y Y M W Q V C L I 
N T 0 B E L E A R N E D F R 0 M T H E 0 P E N I N G 
24 
P T W T J Y Q B Y R L I T U 0 U S R C D C V W D G I 
P H A S E 0 F A L L E N B Y S B A T T L E 0 F M E G 
25 
G G U B H J V V P W A B U J K N F P F Y W V Q Z Q F 
G I D 0 I S T H A T S U R P R I S E I S P 0 S S I B 


~ LHTWJPDRXZOWUSSGAMHNCWHSWW 
LEEVENINMODERNWARFAREBUTON 


~ LRYQQUSZVDNXANVNKHFUCVVSSS 


L Y B Y P E R F E C T D I S C I P L I N E 0 N T H E 
28 
P L Q U P C V V V W D G S J 0 G T C H D E V Q S I J 
P A R T 0 F T H E T R 0 0 P S A N D A L M 0 S T S U 


29 
P H Q J A W F R I Z D W X X H C X Y C T M G U S E S 
PERHUMANFORETHOUGHTANDATTE 
30 
N D S B B K R L V W R V Z E E P P P A T 0 I A N E E 
N T I 0 N T 0 D E T A I L 0 N T H E P A R T 0 F T H 


31 
E E J N R C Z B T B L X P J J K A P P M J E G I K R 
E S T A F F B A C K E D U P B Y R E S 0 L U T E A C 
23 
T G F F H P V V V Y K J E F H Q S X J Q D Y V Z G R 
T I 0 N I N T H E A I R X T 0 M A I N T A I N S E C 
33 
R H Z Q L Y X K X A Z 0 W R R X Y K Y G M G Z B Y N 
R E C Y M 0 V E M E N T S M U S T B E U N D E R C 0 
34 
V H Q B R V F E F Q L L W Z E Y L J E R 0 Q S 0 Q K 
V E R 0 F D A R K N E S S A N D C 0 V E R E D B I V 
35 
0 M W I 0 G M B K F F L X D X T L W I L P Q S E D Y 
0 U A C A R E A S M U S T B E 0 C C U P I E D D U R 
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1 
2 
3 
4 
5 
6 
7 
8 
9 
10 11 12 11 14 15 16 17 18 19 20 21 22 23 24 JS 26 


36 
I 0 E M 0 I B J M L N N S Y K X J Z J M L C Z B M S 
I N G D A Y L I G H T H 0 U R S X U N 0 B S E R V E 


37 
D J W Q X T J V L F I R N R X H Y B D B J U F I R J 
DDAYLIGHTMOVEMENTSWILLREQU 
38 
I C T U U U S K K W D V M F W T T J K C K C G C V S 
I R E T H E R E S T R I C T I 0 N 0 F H 0 S T I L E 


39 
A G Q B C J M E B Y N V S S J K S D C B D Y F P P V 
A I R 0 B S E R V A T I 0 N B Y A N T I A I R C R A 


40 
F D W Z M T B P V T T C G B V T Z K H Q D D R M E Z 
F T A R T I L L E R Y A N D C 0 M B A T A V I A T I 
41 
0 0 
0 N 


WITH THE IMPROVEMENTS IN THE AIRPLANE AND THE MEANS OF COMMUNICATION AND WITH 
THE VAST SIZE OF MODERN ARMIES STRATEGIC SURPRISE WILL BECOME HARDER AND 
HARDER TO ATTAIN X IN THE PRESENCE OF MODERN AVIATION AND FAST MOVING MECHANIZED 
ELEMENTS GREATER COMPLEXITIES MORE SUBTLE DECEPTIONS STRATEGEMS AND FEINTS 
WILL HAVE TO BE EMPLOYED X IN MODERN WARFARE IT IS STILL POSSIBLE TO GAIN 
TACTICAL SURPRISE BY MANY MEANS X WHILE THE MEANS OF OBSERVING AND TRANSMITTING 
INFORMATION OF TROOP MOVEMENTS ARE GREATLY IMPROVED OVER THOSE OF THE PAST THE 
MECHANICAL MEANS OF MOVING TROOPS ARE LIKEWISE FAR SPEEDIER X ALSO FALSE 
INFORMATION CAN BE FAR MORE EASILY AND QUICKLY DISTRIBUTED X THE LESSON TO BE 
LEARNED FROM THE OPENING PHASE OF ALLENBYS BATTLE OF MEGGIDO IS THAT SURPRISE IS 
POSSIBLE EVEN IN MODERN WARFARE BUT ONLY BY PERFECT DISCIPLINE ON THE PART OF THE 
TROOPS AND ALMOST SUPERHUMAN FORETHOUGHT AND ATTENTION TO DETAIL ON THE PART OF 
THE STAFF BACKED UP BY RESOLUTE ACTION IN THE AIR XTO MAINTAIN SECRECY MOVE- 
MENTS MUST BE UNDER COVER OF DARKNESS AND COVERED BIVOUAC AREAS MUST BE OCCUPIED 
DURING DAYLIGHT HOURS X UNOBSERVED DAYLIGHT MOVEMENTS WILL REQUIRE THE RESTRIC- 
TION OF HOSTILE AIR OBSERVATION BY ANTIAIRCRAFT ARTILLERY AND COMBAT AVIATION 


le The student should clearly understand the real nature of the matchmg process employed 
to such good advantage m tlns problem 
Jn practically all the previous cases frequency distn- 
butions were made of cipher letters occurnng m a cryptogram, and the tallies in those dlStnbu- 
tions represented the actual occurrences of cipher letters 
Furthermore, when these distnbu- 
tions were compared or matched, what were being compared were actually cipher alphabets 
That is, the text was aITanged in a certain way, so that letters belonging to the same cipher alpha.bet 
actually fell within the same column and the frequency distnbution for a specific cipher alpha.bet 
wa.3 made by tabula.ting the letters m that column 
Then rl any distnbutions were to be com- 
pared, usually the entire distnbution apphcable to one cipher alpha.bet was compared with the 
entire distnbution applying to another cipher alpha.bet 
But in the problem JUSt completed, 
what were compared in reahty were not frequency d1stnhutions applying to the columns of the 
cipher text as tranqrnbed on p 83, but graphic representations of the var1a.t1ons in the frequencies 
of plain-text letters falling in identical sequences, the uientities oj these plain-text letters being 
unknown for the moment 
Only after the reconstruction has been completed do their identities 


become known, when the plain text of the cryptogram is established 
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61 Alternative method of solution -a The foregomg method of solut10n is, of course, 
almost entirely statistical m nature 
There is, however, another method of attack which should 
be brought to notice because ID some cases the stat1st1cal method, IDvolvmg the study of rela- 
tively large d1stnbutions, may not be feasible for lack of sufficient text 
Yet m these cases there 
may be sufficient data ID the respective alphabets to permit of some assumptions of values of 
cipher letters, or there may be good grounds for applymg the probable-word method 
The 
present paragraph will therefore deal with a method of solvmg progressive cipher .. ystems which 
is based upon the apphcat10n of the prmciples of mdrrect symmetry to certam phenomena ansmg 
from the mechamcs of the progressive enc1pheiment method itself 
b Take the two sequences below and encipher the phrase FIRST BATTALION by the pro- 


gressive method, shdmg the cipher component to the left one mterval after each enc1pherment 


COMPONENTS 


Plam_________________ H Y D R A U L I C B E F G J K M N 0 P Q S T V W X Z 
Cipher _______________ F B P Y R C Q Z I G S E H T D J U M K V A L W N 0 X 


MESSAGE 


I 
2 
3 
4 
5 
6 
7 
8 910lll21314 
Plam _______________________ F I R S T B A T T A L I 0 N 
Cipher _____________________ E I C N X D S P Y T U K Y Y 


c CertaID letters are repeated m both plam text and cipher text 
Consider the former 
There are two I's, three T's, and two A's 
Their encipherments are isolated below, for con- 
vemence ID study 


Plam ___________ ------- 
Cipher _______________ _ 
Plain _________________ _ 


C1 pher _____ ----------- 
Plam _____________ ----- 
Cipher---------------_ 


F I R S T B A T T A L I 0 N 
1 
2 
8 • 5 
6 
7 
8 
II 
10 11 12 13 1' 


I 
I 
I 
K 
T 
TT 
x 
p y 


A 
A 
s 
T 


( 1) 
(2) 
(3) 
(4) 


( 5) 
(6) 


The two I's in hne (1) are 10 letters apart, reference to the cipher component will show that the 
mterval between the cipher equivalent of the first IP (which happens to be I 0 ) and the second Ip 
(wluch is K0 ) 18 10 
Consideration of the mechamcs of the enciphenng system soon shows why 
this is so: since the cipher component is displaced one step with each encipherment, two identical 
letters n mtervals apart m the plam text must yield cipher eqmvalents which are n mtervals 
apart m the cipher component 
Exammation of the data ID hnes (3) and (4), (5) and (6) will 


confirm this findmg 
Consequently, it would appear that m such a system the successful apph- 
cat1on of the probable-word method of attack, coupled within mdrrect symmetry, can qmckly 
lead to the reconstruction of the cipher component 
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d Now conS1der the repeated cipher letters m the example under b 
There happens to be 
only two cases of repetit10n, both mvolvmg Y's 
Thus 


1 
2 
3 
4 
6 
6 
7 
8 
9 10 11 
~ u 14 


T 
0 N 
y 
• y y 


Reference to the plam component wtll show that the plam-text letters represented by the three 
Y's appear m the order N O 
T, that 1.3, reversed with respect to their order m the plam text 
But the mtervals between these letters is correct 
Agam a considerat10n of the mechamcs of 
the enciphenng system shows why this is so 1:1mce the cipher component is displaced one step 
with each enc1pherment, two identical letters n mtervals apart m the cipher text must represent 
plam-text letters which are n mtervals apart m the plam component 
In the present case the 


drrect10n m which these letters run m the plam component is opposite to that m which the 
cipher component is displaced 
That is, if the cipher component is displaced toward the left, 
the values obtamed from a study of repeated plam-text letters give letters which comcide m 
sequence (mterval and drrect10n) with the same letters m the cipher component, the values 
obtamed from a study of repeated cipher-text letters give letters the order of which must be 
reversed m order to make these letters comcide m sequence (mterval and drrect10n) with the 
same letters m the plam component 
If the cipher component is displaced toward the nght, this 
relationship is merely reversed the values obtamed from a study of the repeated plam-text 
letters must be reversed m their order when placmg them m the cipher component, those yielded 
by a study of the repeated cipher-text letters are mserted m the plam component m their origmal 
order 
e Of course, if the prrmary components are identical sequences the data from the two 
sources referred to m subparagraphs c and d need not be kept separate but can be combmed 
and me.de to yield the pnmary component very qmckly 
j With the foregomg pnnciples as background, and given the followmg message, which is 


assumed to begm with COMMANDING GENERAL FIRST ARMY (probable-word method of attack), 
the data yielded by this assumed text are shown m Figure 15 


I K M K I 
F NI I G 
L I D 0 L 
X GA M X 


MESSAGE 


W LPN M 
C A D U V 


v w p x w 
A Z V I S 
DUFF T 
Y N U N L etc , etc 


1 
2 a 4 
6 o 1 s D ro 11 
~ u 14 ~ w n IB 
~ ~ fil ~ ~ ~ ~ z 


Assumed plam text C 0 M M A N D I N G G E N E R A L F I R S T A R M Y 
Cipher ________________ I K M K I L I D 0 L W L P N M V W P X W D U F F T F 


• 
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A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
1~-~---------'-------------- 
2 
K 
---------------------------- 
3 
M 
'--------------------------- 
4 
K 
'--------------------------- 
5 I 
,___ ________________________ _ 


6 
L 
-------------------------- 
7 
I 
-------------------------- 
8 
D 
,___ ________________________ _ 


9 
0 


~------------------------- 
10 
L 
'--------------------------- 
11 
w 
---------------------------- 
12 
L 
'--------------------------- 
13 
p 
-------------------------- 
14 
N 
"--------------------------- 
15 
M 
f----------------------'"----·- 


16 v 
,____ ________________________ _ 


17 
w 
,___ ________________________ _ 


18 
p 
,___ __________________________ ,_ 


19 
x 
,___ ________________________ _ 


20 
w 
---------------------------1- 
21 
D 
-------------------------,- 
22 
u 
-------------------------- 
23 F 
,____ ________________________ ,_ 


24 
F 


:: ==========F=I======F====;.= 


FIGURE H 


AnaJyslS of the data afforded by Figure 15, m conJunctJ.on with the pnnciples of mdirect sym- 
metry, yi.elds the following partial components 


1 
2 
'J 
4 
5 
6 
7 
8 
9 
10 11 12 18 14 15 16 17 18 19 20 21 22 23 24 25 26 


Plam _________ ------- A 
L I c 
EFG 
MN 0 
s 
YDR 
Cipher _______________ { D 
MKV 
L W N 0 
F 
p 
I 
T 


• 
x 


Settmg the two pe.rti.al components mto Juxtaposition so that Cp=I. (first encipherment) the 
8th value, IP=D0 , gives the poSltJ.on of D m the cipher component and permits the addition of X 
to it, these bemg two letters which until now could not be placed mto poSltion m the cipher 
component 
With these two pe.rtle.l sequences it becomes posSlble now to decipher many other 


93 


letters m the message, ge.ps bemg filled m from the context 
For example, the first few letters 


after ARMY decipher as follows 
1 2 a ' a 6 7 s a m n d 
Cipher______________ N I I G X G A M X C A D 
Plam________________ 
I L 
E 0 
R 


The word after ARMY 18 probably WILL 
Tlus leads to the msertion of the letter W m the ple.m 


component and Gm the cipher component In a short tune both components can be completely 
este.bhshed 
g In pe.sS10g, it may be well to note that m the illustrative message m pa.re.graph 50a the 


very frequent occurrence of tripled letters (MMM, WWW, FFF, etc) mdlcates the presence of a 
frequently used short word, e. frequently used ending, or the hk:e, the letters of which a.re sequent 
m the ple.m component 
An astute crypte.ne.lyst who has noted the frequency of occurrence 
of such tnplets could assume the value THE for them, go through the entire text reple.cmg all 
triplets by THE, e.nd then, by e.pplymg the pnnciples of indirect symmetry, bwld up the plam 
component m a short tune 
With that much as a start, solution of the entire message would be 
coDBldere.bly sunphfied. 


h The pnnciples elucidated m thl8 pa.re.graph me.y, of course, e.lso be apphed to cases of 
progreSSlve systems m which the progreSSlon 18 by mtervals greater than 1, and, with necessary 
modifications, to cases m which the progres8lon 18 not regule.r but follows a specific pattern, such 
as 1-2-3, 1-2-3, 
, or 2-5-7-3-1, 2-5-7-3-1, and so 
The latter types of progression 
are encountered m certe.m meche.nical cryptogre.phs, the study of which will be reserved for 
future texts 


1315922-39-'l 


8ECT10N XIV 


THE "MONOALPHABETICITY" OR "cI> TEST" 
Paragraph 


Purpose of the • test _____ ----------------------- -------- __ ----- ----------------------------------------- ----- _ ----- ------ 
52 


Der1vat1on of the • test--------------------------------------- ---------------------------------------------------------------- ___ 
5.:1 
69. Purpose of Ule ~ (phi) test -a The student has noted that the x test 18 based upon the 


general theory of comcidences and employs the probability constants "P and Kr 
There is one 


more test of a. related nature winch may be useful for hnn to understand and its explanation 
W1ll be grven m the succeedmg paragraphs 
6 In paragraph 48e it was stated that two monoalphabetic dlstnbutions when correctly 


oombmed will yield a smgle dIStnbution which 1ohould still be monoalphabetic m character 
ThIS question 8.l'lSes, therefore, m the student's mmd Is there a test whereby he can ascertam 
methematically whether a dIStnbution IS monoalpho.betic or not, especially m the case of one 
which has relatively few data? Such a test has been deVISed and 18 termed the "4> (pin) test" 


68. Denn.tloJl of the 4> test.-a Consider a monogra.phlc or unihteral frequency d1stnbution 
which 18 monoalphabetic m compoSltion 
If there 1s a total of N letters m the d1Stnbut1on, 
N(N-1) 
ma system m winch there are n possible elements, then there 1s a possible total of --2-- 


pairs of letters (for companson purposes) 
b Let the symbolfA represent the number of occurrences of A,fB the number of occurrences 


of B, and so on tofz 
With regard to the letter A then, there arefA <J;-l) comc1dences 
(Agam 


the combmat1ons of fA thmgs taken two at a time) With regard to the letter B, there are 


fB(f~-l) comc1dences, and so on up tofz(fz2-l) comc1dences for the letter Z Now it has been 


N(N-1) 
seen that accordmg to the " test, m 
2 
compansons of letters formmg the two members 


IC N(N-1) 
of p8.ll'S of letters m normal Enghsh plam te"l:t, there should be " 
2 
comcidences, where 


«.,,is the probab1hty of monographlc comc1dence for the lnnguuge m que'!tion 


c Now the expected value of fA(f;-l) +f8 (f~-l) + 
+fz(f~-l) is equal to the theoret- 


N(N-1) 
ical number of comcidences to be expected m 
2 
compansons of two letters, which for 
N(N-1) 
N(N-1) 
normal plam text 1s «.,, times 
2 
and for random text is "• times 
2 
That is, for 


plam text 
Expected value offA(fA-l)-tf8 <Ja-l) + 
2 
2 
+fz(fz-1) 
2 
N(N-1) 


1e.,, X 
2 
, or 


(IX) Expected value off.A(f.A-I)+fB(fB-1)+ 
text 


+fzlfz-l)=KpN(N-1), and for random 


Expected value of fA(jA-l)-tf._8 (f8-l) + 
2 
2 
+fz(fz-1) 
X N(N-1), 
2 
"• 
2 
or 
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(X) Expected value offA(j.A-I)+fB(fB-1)+ 
+fz(fz-l)=«.N(N-1) 


If for the left-hand side of equations (IX) and (X) the symbol E (~) 18 used, then these equations 
become 


(XI) 


(XII) 


Fo1 plam text 


For random text 


E(cI>,,)=te.,,N(N-1) 


E(cI>,)=te,N(N-1), 


where E(cI>) means the average or expected value of the expression m the parenthesIS, "" and 
"' are the probabilities of monogra.phic comc1dence m plam and m random text, respectively 


d Now m normal EnglISh plam text it has been found that 1e,,= 0667 
For random text 


of a 26-letter alphabet 1e,= 038 
Therefore, equations (XI) and (XII) may now be wntten 
thus 
(XIII) 


(XIV) 


For normal EnglISh plam text 


For random te~t (26-letter alphabet) 


E(cfl.,,)= 0667 N(N-1) 


E(cI>,)= 0385 N(N-1) 


e By employmg equations (XIII) and (XIV) it becomes possible, therefore, to test a :rxeee 


of text for monoalphabeticity or for "randomness " That IS, by usmg these equations one can 
mathematically test a very short cryptogram to ascertam whether it 18 a monoalphabetically 
enciphered substitution or mvolrn'! several alphabets so that for all practical purposes it is 
equivalent to random text 
ThlB test has been te1 med the cl> test 
64 Applying the cl> test -a Given the followmg short piece of text, is it hkely that it is 


normal English plam text enciphered monoalphabet1cally? 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 
N=25 


~~~~~ 
~ 
~~ 
~ 
~ 
~ 


For t1us case the observed value of cl> IS 


(1 XO)+ (1 XO)+ (2Xl)+ (3 X2)+(4 X3)+ (2X I)+ (1 XO)+ (4X3)+ (2X I)+ (1 XO)+ (1 XO)+ 


(3X2)=2+6+12+2+12+2+6=40 
If t1us text were monoalphabet1cally enciphered English plam text the expected value of 4> 18 


E(c1>,,)=1e,,N(N-l)= 0667X25X24=40 O 


If the text were random text, the exp~cted value of cl> is 


E(4>,)=1e,N(N-l)= OJ85X25X24=23 1 


The conclusion IS warranted, therefore, that the cryptogram is probably monoalphabet1c sub- 
st1tut1on, smce the observed value of <1>(40) more closely approXImates the expected value for 
English plam text (40 O) than it does the expec.ted value for random text (23 1) 
(As a matter 
of fact, the cryptogram was enciphered monoalphabetically ) 
b Here is another example 
Given the followmg senes of letters, does it represent a 
selection of English text enciphered monoalphabetically or does it more nearly represent a 
random selection of letters? 


YOUIJ 
ZMMZZ 
MRNQC 
XIYTW 
RGKLH 
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The dlStnbution and calculation are as follows 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 
- 
--~---~-- 
-~ -- 
--~~ 
f(j-1) .. 
0 0 0 2 0 0 0 6 0 0 
0 2 
0 0 
0 0 2 6 


I.j(j-1)= 18 (That 181 observed value of cl>= 18) 


E(<l>p)= 0667X25X24=40 0 (That 18, expected value of <1>p=40 O) 


The conclusion IS that the senes of letters does not represent a select10n of English text mono- 
a.lphabet1cally enciphered 
Whether or not 1t represents a random selection of letters cannot 
be told, but it may be said that If the letters actually do constitute a. cryptogram, the latter 1s 
probably polyalphabet1cally enciphered 
(As a matter of fact, the latter statement IS true, for 
the message was enciphered by 25 alphabets used m sequence ) 
c The cl> test is, of course, closely related to the x test and denves from the same general 
theory as the latter, which is that of comc1dence 
When two monoalphabet1c d1stnbut1ons 
have been combmed mto a smgle d1stnbut10n, the x test may be applied to the latter as a check 
upon the ti test. It IS also useful m testing the columns of a supenmpos1t10n diagram, to ascer- 
tam whether or not the columns a.re monoalphabetic 


SECTION XV 


CONCLUDING REMARKS 


Paragraph 


Concludmg remarks on apenodic substitution systems----------------------------------------------------------·----------- 
55 
Synoptic table --------------------------------·--·--------------------------------------------·---------------------------------------- 
li6 


55. Concludmg remarks on apenodic substitution systems.-a The vanous systems 


described m the foregomg pages represent some of the more common and well-known methods 
of mtroducmg complexities m the general scheme of cryptographic subst1tut1on with the view 
to avo1dmg or suppressmg penodw1ty 
There are, of course, other methods for accomplishing 
this purpose, which, while perhaps a bit more complex from a practical pomt of VIew, yield more 
desirable results from a cryptographic pomt of VIew 
That 1s, these methods go deeper mto the 
heart of the problem of cryptographic secunty and thus make the task of the enemy crypt- 
analyst much harder 
But studies based on these more advanced methods will have to be 
postponed at this trme, and reserved for a later text 


b Thus far m these studies, aside from a few remarks of a very general nature, no attention 


has been paid to that other large and important class of ciphers, VIZ, transpos1t1on 
It 18 desir- 


able, before gomg further with subst1tut10n methods, that the student gam some understanding 
of how to solve certam of the more simple vanet1es of transpos1t1on ciphers 
Consequently, 


m the text to succeed the present text, the student will temporarily lay aside the vanous useful 
methods and tools that he has been given for the solut10n of subst1tut1on ciphers and will turn 
lus thoughts toward the methods of breakmg down transpos1t1on ciphers 


56. Synoptic ta.ble.-Contammg the plan mst1tuted m previous texts, of summar1zmg the 
textual matenal m the form of a very condensed chart called An Analytical Key for Military 
Cryptanalysis, the outlme for the studies covered by Part III 1s shown on p 119 
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APPENDIX 1 


ADDITIONAL NOTES ON METHOt>S FOR SOLVING PLAIN-TEXT AUTO-KEYED CIPHERS 


Paragraph 


Introductory remarks __ ------------------------------------------------------------------------------------------------------------- 
1 


~mple ''mechanical'' solution ----------------------------------------------------- ----------------------------------------------- 
2 
An other '' 1nechan1cal'' sol u t1on _________ ------------------______ ------------___________ ---------------___ -------------------------- 
3 


Solut1012 of pla.in-text auto-keyed -0ryptograms when the mtroductory key 1s a. word or phrase ___ -------------- 
4 


Subsequent steps after determmmg the length of the mtroductory key __ _ ----------------------------------------- 
5 


Conversion of foregomg aperiodic cipher mto per1od1c form_ _ _______ ------------------------------------------------- 
6 
Concluchng remarks on auto-key systems --------------------- ------- _ ------------------------------------------------------ 
7 


1. Introducnory remarks.-a In paragraph 33 of the text proper it was mdicated that the 
method elumdated m paragraph 32 for solvmg plam-text auto-keyed ciphers is hkely to be suc- 
<'eSsful only if the cryptanalyst has been fortunate m his select10n of a "probable word " 
Or, to 
put it another way, tf the "probable words" which his imagmation leads him to assume to be 
present m the text are really not present, then he is unfortunate, for solut10n will escape him 
Hence, it rn df's1rahle to pomt out other prmciples and methods whicli are not so subject to chance 
But because most of these methods are applicable only m special cases and because m general it 
is true that auto-key systems are no longer commonly encounten•d m practical military cryptog- 
raphy, it v. a,s thought best to exclude the exposition of these prmciples and methods from the 
text proper and to add them m an appendix, for the study of such students as find them of 
particular mterest 
b A complete discuss10n of the solut10n of plam-text auto-key systems, with examples, 
would roqmre a volume m itself 
Only one or two methods will be descnbed, therefore, lenvmg 
the devefopment of additional prmciples and methods to the mgenmty of the student who wishes 
to go more deeply mto thr subject 
The discus<>wn herem will be presented under separ&te 
hC'admgs, dependent upon the types of primary components employed 
c As usual, the types of primfiry components may be classified as follows 
(1) Primary components arc identical 


(a) Both components progress m the same d1rect10n 
(h) Both components progresc.i m opposite directions 


(2) Pnmary components are different 


2. Simple "mechanical" solution -a (1) Takmg up the case wherem the two identical 


primary components progress m the same direction, assume the followmg add1t10nal factors to 
be known by the cryptanalyst 
(a) The prunary components are both normal sequences 
(b) The encipherment is by plam-text auto-keymg 
(c) The enc1phenng equations are ek12=8111 , 8p11=8012 
(2) A message begmnmg QVGLB TPJTF 
is mtercepted, the only unknown factor is 


the m1tial key letter 
Of course, one could try to decipher the meosage usmg each key letter m 
turn, begmmng with A and contmumg until the correct key letter is tried, whereupon plam text 
will be obtamed 
But it seems logical to tlunk that all the 26 possible "decipherments" rmght 


be denved from the first one, so that the process might be much simplified, and tlus is true, as 
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will now be &hown 
Talong the two cipher groups under conSiderstwn, let them be "deciphered" 
with imtial key letter A 


Cipher------------------------------------------- ___ -----------_ --------- QVGLBTPJ'l'F 
Deciphered with keyletter A--------------------------------------- QFBKRCNWXI 
The deciphered text is certamly not "plam text" But if one completes the sequences rmt1ated 
by these letters, usmg the direct standard sequence for the even columns, the reversed standard 
for too odd columns, the plam text sequence is seen to reappear on Qne generatnx It is HOSTILE 
FOR( CE) 
From tlus it appears that mstead of gomg through the labor of makmg 26 succeSSlve 
tnals, willch would consume considerable time, all that is necessary is to have a set of stnps 
beanng the normal direct sequence and another set bearing the reversed normal sequence, and 
to align the <>trips, alternately direct and reversed, to thr first "decipherment " 
The plam text 


will now reappear on one generatnx of the completion diagram 
(See Fig. 1) 


Initial 
key 
Q V G L B T P J T F 
Jetter 
A 
Q F B K R C N W X I 
B 
PGALQDMXWJ 


c 
0 H Z M P E L Y V K 
D 
N I Y N 0 F K Z U L 
E 
MJXONGJATM 
F 
L K W P M H I B S N 
G 
K L V Q L I H C R 0 


H 
J M U R K J G D Q P 


I 
I N T S J K F E P Q 
J 
H 0 S T I L E F 0 R * 
K 
G P R U H M D G N S 


L 
F Q Q V G N C H M T 
M 
E R P W F 0 B I L U 


N 
D S 0 X E P A J K V 
0 
C T N Y D Q Z K J W 
p 
B U M Z C R Y L I X 
Q 
AVLABSXMHY 
R 
Z W K B A T W N G Z 


s 
Y X J C Z U V 0 F A 
T 
X Y I D Y V U P E B 
u 
W Z H E X W T Q D C 


v 
V A G F W X S R C D 
w 
U B F G V Y R S B E 
x 
T C E A U Z Q T A F 
y 
S D D I T A P U Z G 
z 
R E C J S B 0 V Y H 


FIGURE 1 


b The peculiar nature of the phenomenon JUSt observed, mz, a completion diagram with the 


vertical sequences m adjacent columns progressmg m opposite directions, those m alternate 
columns m the same drrection, calls for an explanat10n 
Although the matter seems rather 
mystenous, it will not be hard to understand 
Frrst, it is not hard to see why the letters m 
column 1 of Figure l should form the descendmg sequence QPO 
for these letters are merely 
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the ones resultmg from the succesSive "decipherment" of Qc by the succeas1ve key letters A, B, 
C, 
Now smce the "decipherment" ob tamed from the 1st cipher letter m any row m 


Figure 1 becomes the key letter for "dec1phenng" the 2d cipher letter m the same row, it is 
apparent that as the letters m the 1st column progress ma reversed normal (descendmg) order, 
the letters m the 2d column must progress m a direct normal (ascendmg) order 
The matter 
may perhaps become more clear if enc1pherment is regarded as a process of add1t1on and de- 
cipherment as a process of subtraction. Instead of pnmary components or a V1genere square, 
one may use sunple anthmet1c, ass1gnmg numencal values to the letters of the alphabet, begm- 
nmg with A=0 and endmg with Z=25 
Thus on the basis of the pair of enciphermg equat10ns 
~12 =01ri, 01111=80121 the letter H0 enciphered by key letter Mt with direct pnmary components 
yields T0 
But usmg the followmg numencal values 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 
0 
1 
2 3 4 
6 
6 
7 8 
9 W ll U IB H U M U IB W ~ fil ~ ~ U ~ 


the same result may be obtamed thus Hi>CMt)=7+12=19=T. 
Every time the number 25 is 


exceeded m the addition, one subtracts 26 from it and finds the letter eqUivalent for the remam- 
der 
In decipherment, the process is one of subtract10n 1 For example T0(Mt=19-12=7= 
H11 , D0(Rt)=3-17=[(26+3)-17]=29-17=12=M11 
Usmg this anthmet1cal eqUivalent of 
normal shding-stnp enc1pherment, the phenomenon 3ust noted can be i.et down m the form of a 
diagram (Fig 2) which will perhaps make the matter clear 


1 It will be noted that if the letters of the alphabet are numbered from 1 to 26, m the usual manner, the 


arithmetical method must be modified m a mmor particular m order to obtam the same results as are given by 
employmg the normal V1genere square 
This mod1ficat1on consists merely m subtractmg 1 from the numerical 
value of the key letter 
Thus 


ABCDEFGHIJKLMNOPQRSTUVWXYZ 
1 
2 3 4 
6 
6 
7 8 
0 W ll U 
~ H U M U IB W ~ ~ ~ ~ U ~ ~ 


H.,(Mk) =8+ (13-1) =8+ 12=20=T. 
T.(Mi.) =20-(13-1) =20-12=8=H., 


For an mterestmg extension of the basic idea mvolved m arithmetic cryptography, see 


Hill, Lester S 
Cryptography in an Algebraic Alphabet 
American Mathematical Monthly, Vol XXXVI, 
No 6, 1929 


Ibid Concerning certain linear transformation apparatus of cryptography American Mathematical Monthly, 


Vol XXXVIII, No 3, 1931 
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Q V G L B T P J etc 


Q0 (A1c)=16- 0=16=Q--"'Q F B K R 
V r ( Qi.: ) =21-16= 5=F 
: T 1 l j 
G0 (F1c)= 6- 5= 1=B ___ ~ 
L0(Bt)=ll- 1=10=K 
: 


B0 (Kt)= 1-10=17=R 
: i 


' ' 
' 
* * * * * * * * * * * * * * * * * * * * * * 


l 
t 
I 
I 
I 
I 
I 
I 
I 
I 


Q.(Bt)=16- 1=15=P-P G A i. Q 
V0 (Pt)=21-15= 6=G 
: t l l l 
Ge (Gt)= 6- 6= O=A ___ 
__, 


L.(At)=ll- O=ll=T. 
: I 
Ba(Lt)= 1-11=16=Q 
: : 
' ' ' 
' . ' 
* * * * * * * * * * * * * * * * * * * * * * 


Qa(Cc)=l6- 2=14=0----+0 H z M p 
V0 (01t)=21-14= 7=H 
: ! r 11 
Ga(Ht)= 6- 7=25=Z 
· : 
L (Z )=11-25=12=M 
: : : 
0 
t 
I 
I 
\ 
I 
B0 (Mt)= 1-12=15=P 
: : : : 


FlGVRE2 


Note how homologous letters of the three rows (Jomed by vertical dotted Imes) form alternately 
descendmg and ascending normal sequences 
c When the method of encipherment based upon enc1phenng equations ~,.,=01n, 01112=0011 
is used mstead of the one based upon enmphermg equations ~12 =01rx. 0pn=00 n1 the process 
indicated above IS Blmphfied by the fact that no alternat10n m the direction of the sequences 
1n the complet10n diagram is reqUired 
For example 


Cipher ______________________ Y H E B P D T B J D 
Deciphered A=A________ Y F J K Z C V W F I 
ZGKLADWXGJ 
AHLMBEXYHK 
B I M N C F Y Z I L 
C J N 0 D G Z A J M 
DKOPEHABKN 
E L P Q F I B C L 0 
F M Q R G J C D M P 
GNRSHKDENQ 
*H 0 S T I L E F 0 R 


FIGVRE3 


d (1) In the foregomg example the pnmary components were normal sequences, but the 
case of 1dent1cal nnxed components may be handled m a snmlar manner 
Note the following 


example, based upon the followmg pnmary component (which is assumed to have been recon- 
structed from previous work) 


FBPYRCQZIGSEHTDJUMKVALWNOX 


Message____________ U S I N L 
Y Q E 0 P .... etc 
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(2) First, the message is "deciphered" with the mitrnl key-letter A, and then a completion 
diagram is established, usmg shdmg strips beanng the rruxed pnmary component, alternate 
stnps beann", the reversed i:,equence 
Note Figure 4, m which the plam text, HOSTILE 
FOR( CE}, reapp<'ars on a smgle generatrn: 
Note also that whereas m Figure 1 the odd columns 
con tam the p1 nnary sequence m th<' rever.;;ed order, and the even columns con tam the sequence 
m the direct or<ler, m Figure 4 the .;;1tuat10n is reversed the odd columns contam the primary 
sequence m tJ.e direct order, and the even columns contam the sequence m the reversed order 
This pomt is brought to notice to show that it is immatenal whether the dirPct order is used 
for odd colurrns or for even columns, th' alternation in dirertion is all that is required m this 
type of solut10n 


e (1) There is next to be con.;;1drH''l the case m wlnch the two prnnary components prog1ess 
m oppos1tP dupct10ns [par le (1) (b)] 
Here is a me,.sage, known to have been enciphered by 
reversed standard alphabf.'ts, plam-text auto-keymg havmg been followed 


X T W Z L X H Z R X 


(2) The procedure m tlus case is exactly the same ai:, before, except that it is not necessa1y 
to have any alternation m direct10n of the complet10n sequences, which may be either that of 
the plam component or the cipher component 
Note the solut10n m Figure 5 
Let the student 
ascertam whv the alternat10n m direct10n of the complet10n sequences is not necessary m tlus 
case 
(3) In the foregomg case the alphabets were reversed standard, produced by the shdmg 
of the normal .3equence agamst its reverse 
But the underlymg prmc1ple of solut10n is the same 
even if a nuxed sequence were used mstead of the normal, so long as the sequence is known, the 
procedure to be followed is exactly the same as demonstrated m subparagraphs (I) and (2) hereof 
Note the followmg solut10n 


MESSAGE 


V D D N C 
T S E P A 


Plam component_______ F B P Y R C Q Z I G S E H T D J U M K V A L W N 0 X 
Cipher component_____ X 0 N W L A V K M U J D T H E S G I Z Q C R Y P B F 


Note here that the primary rruxed sequence is used for the complet10n c;equence and that the 
plam text, HOSTILE FOR (CE), comes out on one generatnx 
It is immaterial whether the 


direct or reversed rruxed component is used for the complet10n sequence, so long as all the 
sequences m the diagram progress m the same direct10n 
(See Fig 6 ) 
j 
(I) There remams now to be coni:,1dered only the case m wluch the two components 
are different nuxed sequences 
Let the two primary components be as follows 


Plam_________________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher ______________ F B P Y R C Q Z I G S E H T D J U M K V A L W N 0 X 


and the message 


C F U Y L 
V XU DJ 


U S I N L Y Q E 0 P 
W D A Y K E L U I A 
N T L P V S W J G V 
0 H W B A G N D S K 
X E N F L I 0 T E M 
F S 0 X W Z X H H U 
B G X 0 N Q F E T J 
P I E N 0 C B S D D 
Y Z B W X R P G J T 
R Q P L F Y Y I U H 
C C Y A B P R Z M E 
Q R R V P B C Q K S 
Z Y C K Y F Q C V G 
I P Q M R X Z R A I 
G B Z U C 0 I Y L Z 
S F I J Q N G P W Q 
E X G D Z W S B N C 
H 0 S T I L E F 0 R* 
TNEHGAHXXY 
D W H E S V T 0 F P 
J L T S E K D N B P 
U A D G H M J W P F 
M V' J I '1' U U L Y X 
I{ K U Z b J M A R 0 
V M M Q I D K V C N 
A U K C U T V K Q W 
LJVRMHAMZL 
l l l I l l 1 l l l 
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XTWZLXHZRX 
C J N 0 D G Z A J M 
D K 0 P E H A B K N 
E L P Q F I B C L 0 
F M Q R G J C D M P 
G N R S H K D E N Q 
H 0 S T I L E F 0 R* 
I P T U J M F G P S 
JQUVKNGHQT 
K R V W L 0 H I R U 
LSWXMPIJSV 
MTXYNQJKTW 
NUYZORKLUX 
0 V Z A P S L M V Y 
P W A B Q T M N W Z 
Q X B C R U N 0 X A 
R Y C D S V 0 P Y B 
S Z D E T W P Q Z C 
T A E F U X Q R A D 
U B F G V Y R S B E 
V C G H W Z S T C F 
W D H I X A T U D G 
XEIJYBUVEH 
Y F J K Z C V W F I 
Z G K L A D W X G J 
AHLMBEXYHK 
B I M N C F Y Z I L 


V D D N C T S E P A 
Z V C I Y U Q L V X 
I A Q G R M Z W A F 
G L Z S C K I N L B 
S W I E Q V G 0 W P 
E N G H Z A S X N Y 
H 0 S T I L E F 0 R* 
T X E D G W H B X C 
D F H J S N T P F Q 
J B T U E 0 D Y B Z 
U P D M H X J R P I 
M Y J K T F U C Y G 
K R U V D B M Q R S 
V C M A J P K Z C E 
A Q K L U Y V I Q H 
L Z V W M R A G Z T 
W I A N K C L S I D 
N G L 0 V Q W E G J 
0 S W X A Z N H S U 
X E N F L I 0 T E M 
F H 0 B W G X D H K 
B T X P N S F J T V 
P D F Y 0 E B U D A 
YJBRXHPMJL 
R U P C F T Y K U W 
C M Y Q B D R V M N 
Q K R Z P J C A K 0 
Z V C I Y U Q L V X 


FIGURE 6 
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(2) First "decipher" the message with any arb1tranly selectfld rmt1al key letter, say A, 
and complete the plam component sequence m the first column (Fig 7a) 


Cipher ______ C F U Y L V X U D J 
C F U Y L V X U D J 
C F U Y L V X U D J 
Plam________ L F Q X W X A W S F 
L F Q X W X A W S E 
L F Q X W X A W S E 


M 
MJ 
MJBC 


N 
N'1D 
ND C Y 
,_. 
0 
OC 
OCLI 
P 
PY 
PYNG 


Q 
QU 
QUAJ 


R 
RW 
RWUN 
S 
SQ 
SQKL 


T 
TN 
TNTQ 


U 
UK 
UKYA 


V 
VH 
VHES 


W 
WE 
WEFD 
X 
XB 
XBPB 


Y 
YX 
YXRZ 
Z 
ZT 
ZTDP 


A 
AG 
AEHR 
B 
BZ 
BZJO 
C 
CV 
CVXE 


D 
DM 
DMZW 


E 
EP 
EPOF 


F 
FA 
FAWH 
G 
GR 
GRMM 
H 
H 0 
*H 0 S T 
I 
IS 
ISG 


J 
JL 
JLV 
K 
KI 
KII 


FIGUBll: 7a 
FIGUBll: 7b 
FIGUBll 7c 


Now prepare a stnp beanng the cipher component reversed, and set it below the plam component 
so that F p=L01 a setting given by the 1st two letters of the spunous "plam text" recovered 
Thus· 
Plam____________ A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
Cipher.......... F X 0 N W L A V K M U J D T H E S G I Z Q C R Y P B 


(3) Now opposite each letter of the complet10n sequence m column 1, write its plam- 
component eqmvalent, as given by the Juxtaposed sequences above 
This gives what is shown 
m Figure 7b 
Then reset the two sequences (reversed cipher component and the plam com- 
ponent) so that Qp=F0 (to correspond with the 2d and 3d letters of the spunous plam text), 
write down the plam-component eqmvalents of the letters m column 2, formmg column 3 
Contmue this process, scannmg the generatrices from trme to time, resettmg the two components 
and findmg eqmvalents from column to column, until it becomes evident on what generatnx 
the plam text IS reappearmg 
In Figure 7c it IS seen that the plam text generatrix is the one 


beginnmg HOST, and from th!S pomt on the solution may be obtamed directly, by usmg the 
two pnmary components 
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(4) When the plam component IS also a mIXed sequence (and drlierent from the cipher 


component), the procedure IS identical with that outlmed m subparagraphs (1)-(3) above. 
The fact that the plam component m the precedmg case is the normal sequence IS of no particular 
s1gmficance m the solution, for it acts as a mIXed sequence would act under similar circumstances 
To demonstrate, suppose the two followmg components were used m encipherment of the 
message below 


Plam __ ------------- W B V I G X L H Y A J Z M N F 0 R P E Q D S C T K U 
Cipher-------·------ F B P Y R C Q Z I G S E H T D J U M K V A L W N 0 X 


Message_________ B B V Z U 
D Q X JD 


To solve the message, "decipher" the text with any arbitranly selected nnt1al key letter and 
proceed exactly as m subparagraphs (2) and (3) above 
Thus 


Cipher _________________________ B B V Z U D Q X J D 
"Plam" (9i.:=X) ___________ V Y R I Y Z E F 0 R 


Note the completion diagram m Figure 8 which shows the word HOST 
very soon m the 
process 
From this pomt on the solution may be obtamed directly, by usmg the two pl'lillary 


components 


B B V Z U D Q X J D 
V Y R I Y Z E F 0 R 
IQ NJ 
GEY G 
xv w z 
LL K 0 
*H 0 S T 
YKB 
AHH 
JMV 
ZDX 
M JG 
NGJ 
F BE 
0 I Z 
RTL 
P U I 
ER 0 
Q SA 
D NC 
s p p 
C C F 
T F Q 
KA U 
UZM 
W X D 


FIGURE 8, 
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3. Another "mechanical" solution -a Another "mechamcal" solution for the foregomg 
cases will now be described because it presents rather rnterestmg cryptanalytic sidelights 
Take the message 
R E F E R E N C E 
B 0 0 K S 
A N D 
H I S P R E F E R E N C E I N 
R E F E R E N C E C H A R T S 


REFERENCE 


and enciphe1 it by plam-text auto-key, with normal dnect primary components, mitial key 
settmg Ap=Gc 
Then note the underscored repetitions 


R E F E R E N C E H I S P R E F E R E N C E I N R E F E 
X V J J V V R P G L P A H G V J J V V R P G M V E V J J 
R E N C E B 0 0 K S A N D R E F E R E N C E C H A R T S 
V V R P G F P C Y C S N Q U V J J V V R P G G J H Y K L 


b Nov, suppose the message has been mtercepted and is to be solved 
The only unknown 
factor will be assumed to be the lllltrnl key letter 
Let the message be "deciphered" by means 
of any uutI,tl key letter,2 say A, and then note the underscored repetitions m the spurious plam 
text 


Cipher _____________ X V J J V V R P G L P A H G V J J V V B P G M V E Y._LJ 
"Plam text"______ X Y L Y X Y T W K B 0 M V L K Z K L K H I Y 0 H X Y L Y 


Cipher ------------ V V R P G F P C Y C S N Q U V J J V V R P G G J H Y K L 
"Plum text"------ X Y T W K V U I Q M G H J L K Z K L K H I Y I B G S S T 


The ougmal four 8-letter repetitions now turn out to be two 
different sets of 9-letter repet1t10ns 
Tlus calls for an explana- 


tion 
Let the spurious plam te:1..t, with its ieal plam text be 


transcribed as though one were dealmg with a ~er10dic cipher 
mvolvmg two alphabets, as shown m Figure 9 
It will here be 
seen that the letteis m column 1 are monoalphabetic, and so are 
those m column 2 
In other words, an auto-key cipher, which 
is commonly regarded us a polyalphabetrn, aperiodic cipher, has 
been converted mto a 2-alphaLet, penod1c cipher, the md1v1dual 
alphabets of which are now monoalphabet1c m nature 
The two 


repetitions of X Y L Y X Y T W K represent encipherments of 
the word REFERENCE, m alphabets 1-2-1-2-1-2-1-2-1, the two 
repetitions of L K Z K L K H I Y likewise represent encipher- 
ments of the same word butm alphabets 2-1-2-1-2-1-2-1-2 
c Later on it wtll be seen how this method of convertmg an 
auto-key cipher mto a penod1c cipher may be applied to the 
case where an mtroductory key word is used as the lllltial keymg 
element mstead of a smgle letter, as m the present case 


1-2 
RE 
x y 
FE 
Ly 
RE 
x y 
N C 
T W 
EH 
KB 
I S 
0 M 
p R 
V L 


1-2 
1-2 
E F 
RE 
K Z 
X Y 


E R 
N C 


K L 
T W 
EN 
EB 
K H 
KV 
C E 
0 0 


I Y 
U I 
IN 
KS 
0 H 
QM 
RE 
AN 


XY 
GH 
FE 
DR 


LY 
J L 


l'lav .. t. 


' Except the actual key letter or a letter 13 intervals from it 
See subparagraph (7) below 


1-2 
E F 
K Z 
E R 
K L 
EN 
K H 
C E 
I y 
CH 
I B 
AR 
GS 
T S 
S T 
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d The student has probably already noted that the phenomena observed m this sub- 
paragraph are the same as those observed m subparagraph 2b 
In the latter subparagraph it 


was seen that the direction of the sequences m alternate columns had to be reversed m order 
to brmg out the plam text on one generatnx 
If this reversal is not done, then obVIously the 
plam text would appear on two generatnces, which is eqmvalent to havmg the plam text reduced 
to two monoalphabets 
e When reciprocal components are employed, the spur10us plam text obtamed by "decipher- 
ment" with a key settmg other than the actual one will be monoalphabetic throughout 
Note 
the followmg enc1pherment (with mitial key 'ettmg Av=Gc, usmg a reversed standard sequence 
shdmg agamst the direct standard) and its "decipherment" by settmg these two component& 
Ap=A, 


Plam text___ __________ R E F E R E N C E H I S P R E F E R E N C E 
Cipher----------------- P N Z B N N R L Y X Z Q D Y N Z B N N R L Y 
Spurious plam texL L Y Z Y L Y H W Y B C M J L Y Z Y L Y H W Y 


Here the spurious plam text is wholly monoalphabetic 


f The reason for the exception noted m footnote 2 on page 106 now becomes clear 
For 


if the actual nntial key letter (G) were used, of course the dec1phernLent yields the correct plam 
text, if a letter 13 mtervals removed from G is used as the key letter, the cipher alphabet selected 
for the first "decipherment" is the reciprocal of the real imtial cipher alphabet and thereafter 
all alternate cipher alphabet& are reciprocal 
Hence the spurious text obtamed from such a 


"decipherment" must be monoalphabet1c 
g In the foregomg case the primary components were identical normal sequences progress- 


mg m the same direction 
If they were mIXed sequences the phenomena observed above would 


still hold true, and so long as the sequences are known, the mdrnated method of solution may be 
apphed 
h When the two pnmary components am known but differently mned sequences, this 


method of solut10n is too mvolved to be practical 
It is more practicable to try successive 
m1tial key letters, notmg the plam text each time and resettmg the strips until the correct 
settmg has been ascertamed, as will be evidenced by obtammg mtelhgible plam text 
4 Solution of plain-text auto-keyed cryptograms when the mtroductory key is a word or 
phrase -a In the foregomg d1scuso.10n of plam-text auto-keymg, the mtroductory key was 


a~umed to consist of a smgle letter, so that the subsequent kf'y letters are displaced one letter 
to the right with respect to the text of the message itself 
But sometimes a word or phrase 
may serve this function, m which case the sub.,equent key is displaced as many letters to the 
nght of the nntial plam-text letter of tne message as there are lettero. m the m1tial key 
This 


will not, as a rule, mterfere m any way with the apphcat10n of the prmciples of solut10n set 
forth m paragraph 28 to that part of the cryptogram subsequent to the mtroductory key, and 
a solution by the probable-word method and the study of iepet1tions can be reached 
However, 


it may happen that tnal of this method I'> not successful m certam cryptograms because of the 
paucity of repetit10ns, or because of failure to find a probable word m the text 
When the cipher 
alphabets are known there is another pomt of attack wlnch is useful and mterestmg 
The 
method conSists m findmg the length of the mtroductory key and then solvmg by frequency 
prmc1ples 
Just how this is accomplished will now be explamed 
b Suppose that the mtroductory key word is HORSECHESTNUT, that the plam-text message 


lS as below, and that identical pnmary components progressing m the same direction are used 
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to encipher the message, by enciphenng equat10n 01,;12=0111, 0p11=0a12 
Let the components 
be the normal sequence 
The encipherment is as follows 


1 
2 
3 
4 
G 6 
7 
8 
9 
10 ll u u H w ~ n IB 
~ ro fil ~ ~ ~ ~ ~ 


Key___________________ H 0 R S E C H E S T N U T M Y L E F T F L A N K I S 
Plam_________________ M Y L E F T F L A N K I S R E C E I V I N G H E A V 
Cipher_______________ T M C W J V M P S G X C L D C N I N 0 N Y G U 0 I N 


Key __________________ R E C E I V I N G H E A V Y A R T I L L E R Y F I R 
Plam _____ ----------- Y A R T I L L E R Y F I R E E N E M Y I S M A S S I 
Cipher _______________ P E T X Q G T R X F J I M C E E X U J T W D Y X A Z 


Key __________________ E E N E M Y I S M A S S I N G T R 0 0 P S T 0 L E F 
Plam_________________ N G T R 0 0 P S T 0 L E F T F R 0 N T A N D C 0 N C 
Cipher _______________ R K G V A M X K F 0 D W N G L K F B H P F W Q Z R H 


Key __________________ T F R 0 N T A N D C 0 N C E N T R A T I N G A R T I 
Plam_________________ E N T R A T I N G A R T I L L E R Y T H E R E X W I 
Cipher _______________ X S K F N M I A J C F G K P Y X I Y M P R X E 0 P Q 


Key ___________________ L L E R Y T H E R E X W I L L N E E D C 0 N S I D E 
Plam_________________ L L N E E D C 0 N S I D E R A B L E R E I N F 0 R C 
Cipher _______________ W W R V C W J S E W F Z M C L 0 P I U G W A X W U G 


Key __________________ R A B L E R E I N F 0 R C E M E N T S T 0 M A I N T 
Plam_________________ E M E N T S T 0 M A I N T A I N M Y P 0 S I T I 0 N 
Cipher _______ ------ V M F Y X J X W Z F W E V E U R Z R H H G U T Q B G 


It will now be noted that smce the mtroductory key contams 13 letters the 14th letter of the 
message is enciphered by the 1st letter of the plam text, the 15th by the 2d, and so on 
Likewise, 


the 27th letter IS enciphered by the 14th, the 28th by the 15th, and so on 
Hence, if the 1st 


cipher letter IS deciphered, this will give the key for deciphenng the 14th, the latter will give 
the key for the 27th, and so on 
An unportant step m the solut10n of a message of this kmd 
would therefore mvolve ascertammg the length of the mtroductory key 
This step will now 
be explamed 
c Smee the plam text itseH constitutes the key letters m this system (after the mtroductory 
key), these key letters will occur with their normal frequencies, and this means that there will 
be many occurrences of E, T, 0, A, N, I, R, S, enciphered by Ei., there will be many occurrences 
of these same high-frequency letters enciphered by Ti., by Oi., by Ai., and so on 
In fact, the 
number of tunes each of these combmat10ns will occur may be calculated statistically 
With 


the enciphenng conditions set forth under b above, EI> enciphered by Ti., for example, will yield 
the same cipher eqmvalent as TI> enciphered by Ei., m other words two encipherments of any 
pair of letters of which either may serve as the key for enciphenng the other must yield the same 
cipher resultant 8 It is the cryptographic effect of these two phenomena workmg together 
which penmts of ascertalillilg the length of the mtroductory key m such a case 
For every 


time a given letter, 0p, occurs m the plam text it will occur n letters later as a key letter, 9i., and 
nm this case equals the length of the mtroductory key 
Note the followmg illustration 


• It is rmportant to note that the two components must be identical sequences and progress m the same 
direction 
If this is not the case, the entire reasonmg lS mapphcable 
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1 
2 
3 
4 
5 
6 
7 
8 
9 
10 11 12 13 
1 
(1) Key __ ---------- H 0 R S E C H E S T N U T 
(2) Plam___________ 
T 
(3) Cipher ________ _ 


1 
2 
3 
{ 
5 
6 
7 
8 
g 
(1) Key_____________ 
E 
(2) Plain___________ 
T • 


(3) Ciphei_________ 
X 


:r 
3 
4 
5 
6 
7 
8 
9 
10 11 12 13 
T 
E 
x 


Here it will be noted that EI> m lme (2) has a TI> on either side of 1t, at a distance of 13 mtervals, 
the first enc1pherment (EI> by Ti.) yields the same eqmvalent (X.) as the second enc1pherment 
(TI> by Eq.) 
Two cipher letters are here identical, at an mterval equal to the length of the mtro- 
ductory key 
But the converse is not true, that IS, not every pair of identical letters m the cipher 
text represents a case of this type 
For m this system identity m two cipher letters may be 
the result of the followmg three conditions each haVIng a statistically ascertamable probab1hty 
of occurrence 
(1) A given plam-text letter 1s enciphered by the same key letter two different times, at an 
mterval which 1s purely accidental, the cipher eqmvalents are identical but could not be used 
to give any mformation about the length of the mtroductory key 
(2) Two different plam-text letters are enciphered by two different key letters, the cipher 


eqmvalents are fortmtously identical 


(3) A given plam-text letter is enciphered by a given key letter and later on the same plam- 
text letter serves to encipher another plam-text letter which is identical with the first key letter, 
the cipher eqmvalents are causally identical 


It can be proved that the probabihty for identities of the third type is greater than that for 


identities of either or both 1st and 2d types for that interval which corresponds with the length 
oj the introductory key, that is, if a tabulation is made of the mtervals between identical letters m 
such a system as the one bemg studied, the mterval which occurs most frequently should comcide 
with the length of the mtroductory key 
The demonstrat10n of the mathematical basis for this 


fact is beyond the scope of the present text, but a practical demonstrat10n will be convmcmg 
d Let the illustrative message be transcnbed m Imes of say 11, 12, and 13 letters, as m 


Figure 10 


1 
2 
3 
4 s 6 
7 
8 
9 
10 11 
T M C W J V M P S G X 
C L D C N I N 0 N Y G 
U 0 I N P E T X Q G T 
R X F J I M C E E X U 
J T W D Y X A Z R K Q 
V A M X K F 0 D W N g 
L K F B H P F W Q Z R 
H X S K F N M I A J C 
F G K E Y X I Y M P R 
x E 0 E Q w w R v c w 
J S E W F Z M C L 0 P 
I U G W A X W U G V M 
F Y X J X W Z F W E V 
EURZRHHGUTQ 
BG 


• 


131>922-39-8 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 11 12 
T M Q W J V M P S g X C 
L D Q N I N 0 N Y g U 0 
I N P E T X Q G T R X F 
J I M C E E X U J T W D 
YXAZRKGVAMXK 
E 0 D W N G L K F B H P 
E W Q Z R H X S K F N M 
I A J C F G K P Y X I Y 
M P R X ~ 0 P Q W W R V 
C W J S ~ W F Z M C L 0 
P I U G W A X W U G Y M 
F Y X J X W Z F W E y E 
U R Z R H H G U T Q B G 


~ 


FIGURJ: 10 


1 
2 
3 
4 
5 
6 
7 
8 
9 
10 11 
12 13 
T M C W J V M P S G X C L 
D C N I N 0 N Y G U 0 1 N 
P ~ T ~ Q G ! R X F J 1 M 
C ~ E X U J ! W D Y X A Z 
R K G V A M X K F 0 D W N 
G L K E B H P F W Q Z R H 
X S K E N M I A J C F G K 
P Y X I Y M P R X E 0 P Q 
W W R V C W J S E W F Z M 
C L 0 P I U G W A X ! U G 
V M F Y X J X ! Z F W E V 
E U R Z R H H G U T Q B G 


• 


11 
I 


I 
11 
'I 


II 
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In each transcr1ptlon, every pair of supenmposed letters is noted and the number of 1dent1t1ec; 
is md1cated by nngmg the letters mvolved, as shown nbovc 
The number of identitie'> for on 
ac;sumed mtroductory-key length 13 is 9, as agumst 3 for the ac;sumpt10n of a key of 11 letterb, 
and 5 for the assumption of a key of 12 letters 


e Once havmg found the length of the mtroductoiy key, two hnes of attack are pob..,1hle 


the composition of the key may be studied, wlnd1 "ill yield sufficient plam te"Ct to get a st ,11 t 
toward solut10n, or, the message mny be reduced to penochc terrnc; and c;olved as a repeatmg-kcy 
cipher 
The first lme of att<tck \\'ill be discusc;ed hrst, it bemg constantly borne m mmd rn tln<> 


paragraph that the entll'e discussion is based upon the assumption that the mpher alphaLets 
are known alphabets 
The illustrative message of b above "ill be usPd 
6 Subsequent steps after determmmg the length of the mtroductory key -a Assume that 
the first letter of the mtroductory key is A and decipher the 1st cipher letter T 0 (with dire< t 
standard alphabets) 
Thie; yields T11 and the latter o~Lomes the key letter for the 14th letter of 
the message 
The 14th letter i<i deciphe1ed 0 0 (Ti)=K11 , the latter bec.omes the key letter for 
the 27th letter and so on, <lown thP entire first column of the mesc;age as transcribed m hnet> of 
13 letters 
The same procedure is follo\\'ed usmg B as the 1mt111l key letter, then C, and so on 
The message as it appears for the foc;t three tnals (assummg A, B, then C as the 1mt111l key letter) 
is c;hown m Figure 11 


1 
2 3 4 
' 
R 7 8 
'I 10 11 12 h 
TMCWJVMPSGXCL 
T 
D 
K 
p 
F c x 
R 
u 
G 
M x 
L 
p 
E w 
s c 
K 
v 
L 
E 
T 


' 
2 , 
4 
' 
f> 
7 
II 
0 JO 11 12 13 
- 
TMCWJVMPSGXCL 
s 
D 
L 
p 
E 
c 
y 


R 
T 
G 
N 
x 
K 
p 
F w 
R 
c 
L 
v 
K 
E 
u 


l 
2 1 4 
' 
~ 7 R 9 10 11 12 11 
TMCWJVMPSGXCL 
R 
D 
M 
p 
D 
c z 
R s 
G 
0 x 
J 
p 
G w 
Q c 
M 
v 
J 
E 
v 


(a) F1r•t column of i'lgure 10 (c) • dtr111h~red I 
(b) rirbt c.ohmm of F1~urc ,o (r) 'du1phucd' I 
(t) ~ ir&t column of FIJlure 10 (<) 
oltc1phc1eu 


wuh mltldl Ok=A 
"1th n11t1al o.-a 
with o.-c 


i•mUIIE 11 
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b Inspection of the resultc; of these three tnals soon shows that the entire senes of 26 
tnals need not be made, for the results can be obtamed from the very first tnal 
This may be 
shown graphically by supenmposmg merely the results of the first three tnals horizontally 
Thus 


Cipher letters of Col 1, Fig IL _______ T D P C R G X P W C V E 


A_________ T K F X U M L E S K L T 
B_________ S L E Y T N K F R L K U 
Keyletters_ - __ C _________ R M D Z S 0 J G Q M J V 


~-~~~~:-~: l l l 1 l 1 l 1 l 1 l l 


FmURJ: 12 


c It will be noted that the vertical sequences m adJacent columns proceed m oppoSite 
direct10nc;, whereas those m alternate columns proceed m the same dircct10n 
The eJ..pl11nat1on 


T D P C R G X P W C V E 
TKFXUMLESKLT 
SLEYTNKFRLKU 
R M D Z S 0 J G Q M J V 
Q N C A R P I H P N I W 
P 0 B B Q Q H I 0 0 H X 
0 P A C P K G J N P G Y 
N Q Z D 0 S F K M Q F Z 
M R Y E N T E L L R E A* 
LSXFMUDMKSDB 
K T W G L V C N J T C C 
J U V H K W B 0 I U B D 
I V U I J X A P H V A E 
H W T J I Y Z Q G W Z F 
GXSKHZYRFXYG 
FYRLGAXSEYXH 
E Z Q M F B W T D Z W I 
D A P N E C V U C A V J 
C B 0 0 D D U V B B U K 
B C N P C E T W A C T L 
ADMQBFSXZDSM 
ZELRAGRYYERN 
YFKSZHQZXFQO 
X G J T Y I P A W G P P 
W H I U X J 0 B V H 0 Q 
VIHVWKNCUINR 
UJGWVLMDTJMS 


FIGUBB 13 


for tlus alternation m progression is the same as m the 
pievious case whcrem tlus phenomenon was encountered 
(par 2b), and the sequences m Figure 12 may now be 
completed very qmckly 
The diagram becomes as shown 
m Figw-e 13 
d One of the honzontal hnes or geneiatnces of figure 
13 is the correct one, that is, it con tams the actual plam- 
text eqmvalents of the 1st, 14th, 27th, 
letters of the 
message 
The correct generatnx can be selected by mere 
ocular examination, as is here possible (see generatnx 
markPd by astensk m Fig 13), or it mav be selected by a 
frequency test, assigmng weights to each letter according 
to its normal plam-text frequency 
(See par 14} of 


Military Cryptanalysis, Part II) 


e Identical procedure is followed with respect to columns 2, 3, 4, 
of Figure 10c, with 


the result that the mitial key word HORSECHESTNUT is reconstructed and the whole message 
may be now deciphered qmte readily 
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6 Conversion of foregomg aper1od10 cipher into per1od10 form -a In paragraph 4 it was 
stated that an apenodic cipher of the foregomg type may be reduced to penodic terms and 
solved as though it were a repeatmg-key cipher, provided the pnmary components are known 
sequences 
The basis of the method hes m the phenomena noted m paragraph 2b 
wtll be given 


An example 


b Let the cipher text of the message of paragraph 4b be set down agam1 as m Figure lOc 


2 
3 • 
5 
6 
7 
8 
0 
10 
11 
12 
13 
T 
M c w J v M p s G x c L 
D c N 
I 
N 
0 
N 
y 
G u 0 
I 
N 
p 
E 
T x Q G T 
R x F 
J 
I 
M 
c E 
E x u J 
T w D y x A z 
R 
K 
G v A 
M x K 
F 
0 
D w N 
G L 
K 
F 
B 
H 
p 
F w Q z R H 
x s 
K 
F 
N 
M I 
A 
J c F 
G K 
p 
y x I 
y 
M p 
R x E 
0 
p 
Q 
w w R v c w J s 
E w F z M 
c L 
0 
p 
I u G w A x w u G 
v M F 
y x J x w z F w E v 
E u R z R H 
H 
G u T 
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Usmg direct standard alphabets (V1gen~re method), "decipher" the second hne by means of 
the first hne, that is, takmg the letters of the second hne as cipher text, those of the first hne 
as key letters 
Then use the thus-found "plam text" as "key letters" and "decipher" the third 


hne of Figure 10c1 as shown m Figure 14 
Thus 


"Key"------------------ T M C W J V M P S G X C L 
Cipher __________________ D C N I N 0 N Y G U 0 I N 
"Plam" ----------------- K Q L M E T Z J 0 0 R G C 


"Key"------------------ K Q L M E T Z J 0 0 R G C 
Cipher __________________ P E T X Q G T R X F J I M 
"Plam" _________________ F 0 I L M N U I J R S C K 


FlGtTBB 14. 


Contmue this operation for all the remammg Imes of Figure lOc and wnte down the results m 
hnes of 26 letters 
Thus 


1 
2 
3 
4 
5 
6 
7 
8 
9 W 11 U 13 H U M U IB ill ~ fil ~ ~ ~ ~ ~ 


T M C !! J Y. M P S G X .Q L K g L M E T fl ~ 0 0 R G C 
F 0 I L M N U I J R S .Q K X g !! M I W fl Q U H F Y .f 
UUKJSQYWLHYYYMRAWJBR~LJ~TJ 
L B K J E V R R Y T E N B E X N Z U R Y A Z L K C P 
- 
- 
- 
- 
-- 
- 


SZEytIFL§FLY.XXKMKTAPVEVM~XJ 


~ A V F X U C § E T Y. H M T U !! U Y N F Q Q A V U U 


FIGtTBE 16 
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Now wnte down the real plam text of the message m hnes of 26 letters 
Thus 


1 
2 
3 
4 
5 6 
7 8 
0 W 11 U 13 H U M U IB ill ~ fil ~ ~ ~ ~ ~ 
MYLEFTFLANK!SBECEIVINGHEAV 
YARTILLERYF!REENEMY!§MASS! 
N G T R 0 0 P S T 0 L E F T F R 0 N T A N D C 0 N C 
ENTRATINGARTILLERYTHEREXWI 
LLNEEDCONSIDERABLEREINFORC 
E M E N T s T 0 M A I N T A I N M y p 0 s I T I 0 N 
- 
- 
-- 
- 
- 
- 


FIGtTBB 16 


c When the underlmed repetitions m Figures 15 and 16 are compared, they are found to be 


identical m the respective columns, and if the columns of Figure 15 are tested, they will be found 
to be monoalphabetic 
The cipher message now gives every mdication of bemg a repeatmg-key 


cipher It is not difficult to explam this phenomenon m the hght of the demonstration given m 
paragraph 3g 
First, let the key word HORSECHESTNUT be enciphered by the followmg alphabet 


A B C D E F G H I J K L M N 0 P Q R S T U V W X Y Z 
A Z Y X W V U T S R Q P 0 N M L K J I H G F E D C B 


"Plam" ----------------- H 0 R S E C H E S T N U T 
"Cipher"--------------- T M J I W Y T W I H N G H 


Then let the message MY LEFT FLANK, etc , be enciphered by direct standard alphabets as 
before, but for the key add the monoalphabetic eqmvalents of HORSECHESTNUT TMJIW 
to 
the key itself, that is, use the 26-letter key HORSECHESTNUTTMJIWYTWIHNGH m a repeatmg-key 
manner 
Thus (Fig 17) 


1 
2 
3 
4 
5 
6 
7 
8 
9 W 11 
~ 13 H U M U IB ill ~ fil ~ ~ ~ ~ ~ 


Key __________________ H 0 R S E C H E S T N U T T M J I W Y T W I H N G H 


Plam_________________ M Y L E F T F L A N K I S R E C E I V I N G H E A V 
Cipher _______________ T M C W J V M P S G X C L K Q L M E T Z J 0 0 R G C 


Plam _________________ Y A R T I L L E R Y F I R E E N E M Y I S M A S S I 
Cipher _______________ F 0 I L M N U I J R S C K X Q W M I W Z 0 U H F Y P 


Plam_________________ N G T R 0 0 P S T 0 L E F T F R 0 N T A N D C 0 N C 
Cipher _______________ U U K J S Q Y W L H Y Y Y M R A W J R R J L J B T J 


Plam_________________ E N T R A T I N G A R T I L L E R Y T H E R E X W I 
Cipher _______________ L B K J E V R R Y T E N B E X N Z U R Y A Z L K C P 


Plam_________________ L L N E E D C 0 N S I D E R A B L E R E I N F 0 R C 
Cipher _______________ S Z E W I F L S F L V X X K M K T A P V E V M B X J 


Plam_________________ E M E N T S T 0 M A I N T A I N M Y P 0 S I T I 0 N 
Cipher _______________ L A V F X U C S E T V H M T U W U U N F 0 Q A V U U 


FIGtTBB 17 


The cipher resultants of this process of enciphering a message commde exactly with those obtamed 
from the "deciphering" operation that gave nse to Figure 15 
How does this happen? 


. I 


I I 
I 
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d Fust, let it be noted that the sequence TMJI 
, which forms the second half of the 
key for enc1phenng the text m Figure 17 may be descnbed as the standard alphabet complement 
of the sequence HORSECHESTNUT, which forms the first half of that key 
Anthmet1cally1 the 
sum of a letter of the first half and its homologous letter m the second half is 26 
Thus 


H+T= 7+19=26=0 
o+M=14+12=26=0 
R+J=17+ 9=26=0 
S+I=18+ 8=26=0 
E+W= 4+22=26=0 


That is, every letter of HORSECHESTNUT plus it., homologous letter of the sequence 
T\IIJIWYTYIHNGH equals 26, wluch is hmc the same as zero 
In other words, the sequence 
TMJIWYTWIHNGH is, by cryptogrnphic anthmetic, eqwvalent to "mmus HORSEC.t-IESTNUT " 
Therefore 
m Figure 17, enciphuing the second half of each lme by the key letters 
TMJIWYTWIHNGH (1 e, addmg 19, 12, 9, 8, 
) 1s the same as deciphering by the key l<'tterl'> 
HORSECHESTNUT (1 e, subtractmg 7, 14, 17, 18, 
) 
For example 


R.p(T1<)=17+19=36=10=K, and 
Rp(-H1<)=17-7=10=K 


Ep(Mk)=4+12=16=Q0 , and 
Ep(-01<)=4-14=(26+4)-14=16=Q0 , and so on 


e Refer now to Figure 15 
The letters m the first half of hne 1, begmnmg TMCWJ 


are 1dentwal with those m the first half of hne 1 of Figure 17 
They must be 1dent1cal because 
they are produced from identical clements 
The letters m the second half of this same hne m 
Figure 15, begmmng KQLME 
were produced by deciphering the letters m the second lme 
of Figure lOc 
Thus (takmg for 1llustrative purposes only the first five letters m each case) 


K Q L M E = D C N I N - T M C W J 


&t DCNIN=RECEI+MYLEF 
And T M C W J = M Y L E F + H 0 R S E 
Hence, 
Or, 


K Q L M E = (R E C E I + 
M Y L E F) - 
(M Y L E F + H 0 R S E) 
K Q L ME= REC EI - 
H 0 RS E 
(1) 


As for the letters m the second half of hne 1 of ]'igure 17, also begmnmg KQLME 
letters were the result of enciphering RECEI by TMJIW 
Thus 
KQLME=RECEI + TMJIW 


But it has been sho'\\n m subparagraph d above that 


Hence, 
Or, 


T M J I W = - H 0 R S E 


K Q L M E = R E C E I + (- H 0 R S E) 
K Q L M E = R E C E I - 
H 0 R S E 
(2) 


, these 


Thus, equations (1) and (2) turn out to be 1dent1cal but from what appear to be qmte diverse 
sources 
j What has been demonstrated m connert10n with the letters m hne 1 of Figures 15 and 
17 holds true for the letters m the other hnes of these two figures, and 1t 1s not necessary to 
repeat the explanation 
The steps show that the ongmally apenodic, auto-key cipher has been 
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converted, through a knowledge of the primary components, mto a repeat.mg-key cipher with a 
penod twice the length of the mtroductory key 
The message may now be solved as an ordmary 
repeatmg-key cipher 
g (1) The foregomg cac;;e 1s based upon enc1pherment by the enciphenng equatrnns 
Si.12=8111, 8p11=8c12 
Wb1:1n enr1pherment by the enciphenng cnuat10ns °- 12=0 
9 -8 
h 
b 
f 11 
·1 
~"I< 
1/11 
p/l- 
C/l 
as een o owed, the conversion of a plnm-text auto-keyed cipher yields a repeatmg-key cipher 
with a penod equal to the length of the mtroductory key 
In this convers10n, the enciphenng 
equations ~12=811i, 8p11=8012 are used m findmg eqmvalents 
(2) An example may be useful 
Note the enripherment of the folloV1<mg message by 
auto-key method by enmphenng equations 8k12=8111, 8p12=8011 


T U E S D A YII N F 0 R M A T I 0 N F R 0 M R E L I A B L E S 0 U R C E S I N D I C 
INFORMATIONFROMRELIABLESOURCESINDICATESTHE 
PTBWOMCLVJZOFOTJQYDJNZNODMRBTOQZJRAWBWFQZC 


(3) If the message is written out m hnes conespondmg to the length of the mtroductory 
key, and each hne 1s enciphered by the one d1rertly above it, usmg the enciphermg equations 
0i.12=811i, 8p11=8012 m findmg eqwvalents, the results are as shown m Figure 22b 
But if the 
same message 1s enciphered by equat10ns 81<12=81/l, 8p12=801i, uo;mg the word TUESDAY as a 
repeatmg key, the cipher text (Fig 18c) 1s identical with that obtamed m Figure 18b by encipher- 
mg each successive hne with the hne above it 


Or1gmal cipher text 


P T B W 0 M C 
LVJZOFO 


TJQYDJN 


Or1g1nal r1phPr te~t 
and con~erted text 


+----- 
PTBWOMC 
L V J Z 0 F 0 


A 0 K V C R Q 
TJQYDJN 


TXATFAD 


Z N 0 D M R B +-----+ Z N 0 D M R B 


TOQZJRA 


\~ B W F Q Z C 


a 


S K 0 W R R E 
TOQZJRA 


LYEVAIE 
W B W F Q Z C 


HZAAQHG 


b 


FiOUBE 18 


+-----+ 


Repeatmg kPy encipher 
ment 
T U E S D A Y 
INFORMA 
P T B W 0 M C 


T I 0 N F R 0 
A 0 K V C R Q 


MRELIAB 
TXATFAD 


L E S 0 U R C 
S K 0 W R R E 


E S I N D I C 
L Y E V A I E 


ATESTHE 
HZAAQHG 
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(4) Now note that the sequences JOmed by arrows m Figure 18 6 and care Identical and smce 


it 18 certain that Figure 18c 18 penod1c m form because it was enciphered by the repeatmg-key 
method, it follows that Figure 18b is now also m penodic form, and m that form the message 
could be solved as though it were a repeatmg-key cipher 
h (1) In case of pnmary components conslStmg of e. direct normal sequence shdmg age.met 
e. reversed normal (U S Army disk), the proceBB of convertmg the e.uto-key text to penod1c 
terms 18 e.ccompl1Shed by usmg two direct normal sequences and "dec1phenng" ea.ch lme of the 
text (e.s tre.nscnbed m periods) by the lme a.hove it 
For example, here 18 a message e.uto- 


enc1phered by the e.forement1oned dlSk, with the lnltial key word TUF.SDAY 
T U E S D A Yj I N F 0 R M A T I 0 N F R 0 M R E L I A B L E S 0 U R C E S I N D I C 
INFORMATIONFROMRELIABLESOURCESINDICATESTHE 
LHZEMOYPFRBMVMHRKCXRNBNMXOJZHMKBRJAEZEVKBY 


(2) The cipher text 18 tie.nscnbed m penods equal to the length of the lnltial key word 
(7 letters) e.nd the 2d lme is "deciphered" with key letters of the let lme, usmg enc1phermg 
equations ~r.i=0111 , 0p11=0cr.i 
'lhe resultant letters are then used as key letters to "decipher" 


the 3d lme of text e.nd so on 
1. he results are as seen m Figure l 9b 
Now let the ongmal mes- 


sage be eneiphered m repeatmg-key manner by the dlBk, with the key word TUESDAY, and the 
result 18 Figure 19c 
Note that the odd or alternate Imes of Figure 19b and c are identical, 


showmg that the auto-key to'\.t has been converted mto repeatmg-key text 


Or1111nal 01pher tut 
Onglnal cipher tut 
Repeating key encipher 


BDd converted text 
ment 
TUESDAY 
INFORMA 


LHZEMOY 
LHZEMOY 
LHZEMOY 
PFRBMVM 
PFRBMVM 
TIONFRO 


AMQFYJK 
AMQFYJK 
HRKCXRN ----- 
HRKCXRN 
MRELIAB 
HDAHVAX 
HD AH VAX 


BNMXOJZ 
BNMXOJZ 
LESOURC 
IQMEJJW 
IQMEJJW 


HMKBRJA 
HMKBRJA 
E S I N D I C 


PCWFASW -------- 
PCWFASW 
EZEVKBY 
EZEVKBY 
ATES THE 


TBAAKTU 
TBAAKTU 
• 
b 
~ 


l'IGURll: 18 


i The foregomg procedures md1ce.te a Simple method of solvmg ciphers of the foregomg 
types, when the pnmary components or the secondary cipher alphabets are known It conBlBts 
m assummg mtroductory keys of vanous lengths, convertmg the <'lpher text mto repeatmg-key 
form, e.nd then exammmg the resultmg diagrams for repetitions 
When a correct key length 18 
assumed, repetitions will be as numerous as should be expected m ciphers of the repeatmg-key 
class, mcorrect assumptions for key length will not show so me.ny repetitions 


3 All the foregoing presupposes e. knowledge of the cipher alphabets mvolved 
When these 


are unknown, recourse must be had to first pnnc1ples e.nd the message& must be solved purely 
upon the bB.BlS of probable words, and repetitions, as outlmed m paragraphs 27-28 
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